Gnosis Pay has confirmed that hackers accessed its consumer card system and exposed some customers' personal information. The company announced the breach on 6 November, three days after its security team detected unauthorised access on 3 November.

In a statement, the company said the incident affected the system powering its Gnosis Pay-branded cards, its business-to-consumer line. "We had a data breach affecting the system powering Gnosis Pay-branded cards (our B2C business line) that resulted in the exposure of certain customer information," the company said. Customer funds were not affected, and the company's enterprise service, which provides white-label card programmes to other businesses, was untouched.

Detected on 3 November, contained within hours

Gnosis Pay said its security team began responding within two hours of detecting the unauthorised access, replacing the affected credentials and fixing the vulnerability used to gain entry. Affected customers were emailed on 6 November with details of which information had been taken from their accounts, along with account-specific recommendations. One affected customer, Rotki founder Lefteris Karapetsas, said his exposed information included his name, home address, card number and linked wallet addresses. The company has not published a total count of affected customers.

Tighter checks until the service closes

As a precaution, Gnosis Pay has made 3D Secure verification compulsory for every online card payment, and increased wallet monitoring. Those measures will remain in place until 20 December 2026, when the company plans to shut down the affected consumer card platform under a previously announced closure. Monavate Limited, the issuer regulated by the UK's Financial Conduct Authority, continues to operate. Gnosis Pay has also warned customers to watch for phishing attempts following the incident.