Gnosis Pay data breach exposes customer info; funds unaffected

Gnosis Pay disclosed a data breach affecting its legacy system powering Gnosis Pay-branded debit cards, exposing certain customer information after unauthorized access was detected on Nov. 3.

The company said it contained the incident within two hours, replaced compromised security credentials and addressed the vulnerability, adding that customer funds were not affected and its enterprise platform powering white-label card programs was untouched.

Gnosis Pay has made 3D Secure verification mandatory for online card payments until the affected system is retired on Dec. 20.

Crypto card providers increasingly rely on third-party infrastructure and legacy systems that can create security vulnerabilities. In recent months, there have been breaches exposing cardholder information and exploits affecting funds held in card accounts.

Based said an attacker accessed an internal dashboard used to manage its Visa card program on Oct. 5. Some customer data was exposed, but the attacker reportedly failed to access deposited funds. In August, a vulnerability in Rain's Solana card infrastructure allowed unauthorized withdrawals from card balances belonging to users of Tria and Avici.

Meanwhile, Revolut said an unauthorized third party used a fraudulent request from a legitimate government email domain to obtain sensitive customer information, potentially including account statements, identity documents and Bitcoin transaction histories. Customer funds and systems were unaffected.