Gnosis Pay now requires 3D Secure for online purchases on its branded cards after unauthorized access exposed customer information, adding a verification step as the company responds to a breach.
In a Nov. 6 statement, the company said its monitoring flagged the access on Nov. 3. Its security staff responded immediately, and containment began within two hours of detection. Gnosis Pay replaced affected credentials, addressed the vulnerability and emailed customers with account-specific information on Nov. 6.
The company has increased monitoring of card activity and wallets. The additional checks are scheduled to end when the consumer-card system is retired on Dec. 20; Gnosis Pay said that date was set before the breach. It said customer funds and its white-label card platform were unaffected.
Gnosis Pay said it had notified partners and was communicating with its card issuer and applicable data protection authorities. It is arranging specialist monitoring for signs of misuse. The company urged customers to check suspicious contact through its official app or a partner app, since fraudulent messages may refer to genuine account or purchase details.
The public statement did not give an affected-customer count or identify the exposed data fields. Cointelegraph, citing notices it reviewed, reported that some included card numbers, expiration dates, CVV security codes, names, home addresses and linked wallet details. Some notices also reportedly listed email addresses, phone numbers, nationalities, IBAN or BIC information. Protos separately reported that customer notices varied, with examples listing shipping addresses and account references.
The incident is separate from a June security breach involving software connected to Gnosis Pay’s card Safe wallet infrastructure. Gnosis said attackers extracted about $1.5 million in that incident, and that it covered the losses and restored affected users’ funds.
