Gnosis Pay, a company known for providing Visa-linked cryptocurrency debit cards, announced on Friday a significant security breach involving the exposure of customers’ payment card details and personal information. The compromised data included card numbers, expiration dates, CVV codes, residential addresses, and crypto wallet addresses connected to affected accounts.
Unauthorized Access Detected on November 3
The breach was identified on November 3rd, when Gnosis Pay detected unauthorized access to its legacy consumer card system. The firm reportedly began containing the breach within two hours. It confirmed that customer funds remain unharmed and that its separate corporate platform, which supports white-label card programs, was not affected. As a fintech service provider, Gnosis Pay issues payment cards linked to cryptocurrency assets.
Gnosis Pay asserted that no customer funds were impacted and that their corporate infrastructure remained secure.
The breach notification revealed that the exposed data extended beyond card information. Names, email addresses, phone numbers, nationality details, and in certain instances, banking data such as IBAN and BIC were also compromised. However, the company did not disclose the number of customers affected by this incident.
Proactive Measures: Card Cancellations and Security Enhancements
In at least one customer notification, confirmation was given regarding the cancellation of the compromised card on November 3rd. The same notification indicated no suspicious transactions or fund movements were detected, suggesting the breach was limited to data exposure, though the sensitive nature of the information keeps potential risks alive.
Gnosis Pay reported that it had renewed compromised security credentials, addressed the vulnerability, and made 3D Secure verification mandatory for online transactions until the old system is retired on December 20th.
Glossary: 3D Secure is an additional authentication layer for online card payments, commonly utilizing one-time passwords sent by banks or mobile confirmation.
Gnosis Pay warned customers of potential phishing attempts using their personal or transactional data.
Transaction Volume Unveiled, Customer Impact Unspecified
The company has prepared monitoring protocols in case the stolen data is misused, emphasizing that personal information and transaction details could be exploited for fraudulent messages or directives.
According to OpenRate, a third-party platform monitoring crypto card operations, Gnosis Pay handles approximately 2,400 active card users daily. In the last 24 hours, transactions totaled $263,200. Nevertheless, Gnosis Pay has not disclosed the total number of customers impacted by the breach.
