Gnosis Pay data breach: card system, funds unaffected

SECURITY ALERT

The money stayed put. The paperwork walked out.

Gnosis Pay says an outsider gained access on 3 Nov to the system that runs its own-brand crypto debit cards, exposing “certain customer information”, according to a company blog post published on Friday 6 Nov.

The company says customer funds were not affected.

Its enterprise platform, which runs white-label card programmes for partner apps, was also not affected, it says.

What the company has confirmed

3 Nov: monitoring systems detect unauthorised access to the consumer card system. Containment starts within two hours, Gnosis Pay says.
After containment: the affected security credentials are replaced and the vulnerability addressed.
6 Nov: every affected customer is emailed with the specific data taken from their account. Partners are told. Gnosis Pay says it is in contact with data protection authorities and its card issuer.
Until 20 Dec: 3D Secure, the extra check at online checkout, is mandatory on all online card payments. The breached system was already due to retire that day.

Gnosis Pay has not said how many customers were affected.

So what exactly left the building?

What was reported, not confirmed

The blog post does not list the data fields.

Breach notifications reviewed by Cointelegraph listed full card numbers, expiry dates and CVV codes, names, home addresses, emails, phone numbers, nationalities and linked wallet addresses. Some also included IBAN and BIC details.

That list comes from customer letters, not from a company statement. It may differ from account to account.

One notification seen by Cointelegraph said the customer’s card had been cancelled on 3 Nov, with no suspicious transactions found.

The Block and Decrypt also reported the breach.

A card can be cancelled. A home address and a list of wallets cannot.

That is why the next threat is a message, not a withdrawal.

Protect yourself

Assume any unexpected contact about your card or account is suspect, by phone, post or message, even when it knows your real name, address or a genuine purchase. Go to the official web app or your partner app directly instead of following a link.
Do not hand over your recovery words, keys, card PIN or the full card number to anyone. Gnosis Pay says it will never request them, never ask you to “re-verify” by email or text, and never ask you to move funds by message or phone.
Read the email Gnosis Pay sent you and follow the specific steps it lists for the data taken from your account.
If your linked wallet addresses were exposed, be careful who learns where you live and what you hold.

This is the same pattern as Keystone’s website breach and the scam calls that followed: no coins lost at first, then the impersonators arrive.

How many card customers will hear from a “support agent” before 20 Dec?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.