{
  "id": "gnosis-pay-card-data",
  "url": "https://ohshit.app/incidents/gnosis-pay-card-data/",
  "title": "Gnosis Pay confirms customer data exposure in its legacy consumer-card system",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-06",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Gnosis Pay",
    "Data breach",
    "Payments"
  ],
  "ecosystems": [],
  "summary": "Gnosis Pay confirms customer-information exposure after November 3 access to its legacy branded-card system. It says funds and its enterprise white-label platform were unaffected, affected customers were emailed, and online card payments now require 3D Secure. Public field categories, customer count and entry mechanism are not disclosed.",
  "splash": "Customers whose information was held in the legacy system powering Gnosis Pay-branded consumer cards; individual notices define exposure.",
  "wipe": "Read your direct notice through official channels, follow its specific actions and reject messages requesting keys, card details or fund transfers.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify your individual exposure and recommended actions",
      "hint": "Open the known Gnosis Pay web app or your established Partner App directly, retain your notice and follow actions tied to the specific information accessed. If concerned or your notice is missing, contact help@gnosispay.com through the official site. No published customer total or universal exposed-field list is given; do not infer non-exposure solely from email delivery."
    },
    {
      "title": "Reject recovery, identity-check and transfer lures",
      "hint": "Do not follow links in unexpected email, texts, calls or letters, even if they cite real details or purchases. Never supply seed phrases, private keys, PINs or full card numbers. Gnosis Pay says it and Partner Apps will not request identity re-verification by email/text or fund movements by email/text/phone; make account changes only inside the official app."
    },
    {
      "title": "Monitor the card and follow the new verification step",
      "hint": "Check card activity and wallet transactions through the official apps; verify suspicious activity with support and the established issuer channel. The company now requires 3D Secure for every online card payment and says monitoring continues. Confirm prompts through your real purchase flow; there is no published customer software patch or universal card replacement/seed-rotation order."
    }
  ],
  "sources": [
    {
      "name": "Gnosis Pay original November 6 breach notice",
      "url": "https://gnosispay.com/blog/data-breach-legacy-system-gnosis-pay-branded-cards",
      "says": "Confirms November 3 access and customer-information exposure in the legacy B2C card system; containment began within two hours, credentials replaced/vulnerability addressed, funds and enterprise platform unaffected according to the company, notices and additional safeguards.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Gnosis Pay confirms unauthorized consumer-card system access and customer data exposure.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 3, 2026",
      "title": "Monitoring detects unauthorized legacy-system access",
      "body": "The company says containment began within two hours of detection; affected credentials were subsequently replaced and the vulnerability addressed. This is not a claim that containment finished within two hours."
    },
    {
      "date": "Nov 6, 2026",
      "title": "Gnosis Pay publishes disclosure and emails affected customers",
      "body": "The company reports increased card/wallet monitoring, mandatory 3D Secure for online card payments, partner notifications and communications with data authorities and its issuer."
    },
    {
      "date": "Dec 20, 2026 (scheduled)",
      "title": "Existing consumer-system retirement remains planned",
      "body": "Additional safeguards are intended to remain until the previously planned retirement. The breach notice does not confirm completed closure or instruct users to transfer funds in response to messages."
    }
  ],
  "body_markdown": "The disclosure concerns customer information in the legacy consumer-card system. Gnosis Pay says its separate enterprise white-label card platform and user funds were unaffected. The public notice does not establish the exact fields, a victim total, confirmed fraudulent spending, stolen seed phrases or a wallet-draining attack. Ask about your own records; a customer’s public screenshot does not define every customer’s exposure.\n\nThe company says it notified every affected customer, replaced credentials and addressed the vulnerability; it is also reviewing the incident and arranging specialist misuse monitoring. These are vendor statements, not an independent audit or proof that copied data was recovered. L4 reflects confirmed customer-data exposure in a payment platform, with scale still unknown. This November event is separate from the June 2026 Zodiac-module funds exploit; do not import that event’s loss or wallet totals."
}