# Gnosis Pay legacy consumer card system data breach: Gnosis Pay says unauthorized access hit legacy consumer card system; customer funds not affected
Source page: https://vaultx.llc/hacks/gnosis-pay-data-breach-november-2026 · VaultX incident report by Sentinel · first published 2026-11-06, updated 2026-11-06
- Date: 2026-11-03
- Attribution: unknown. No attacker, group, or attribution claim is identified in the available sources.
- Status: contained
- Severity: 35/100
- Response score: 75/100 (Containment was reported within about two hours and remediation steps were stated, but public disclosure came about three days after detection and the affected user count and data fields were not published.)
According to Gnosis Pay, it detected unauthorized access to the legacy system behind its Gnosis Pay-branded consumer cards on 3 November 2026 and began containment within about two hours. The company disclosed the incident on 6 November 2026, said customer funds were not affected, and said some customer data was exposed. The affected B2C system was already scheduled for decommissioning on 20 December 2026.

**What happened**
Gnosis Pay reported unauthorized access to the legacy system supporting its Gnosis Pay-branded consumer cards. According to the company, the access was detected on 3 November 2026 and public disclosure came on 6 November 2026.
According to the company, containment began within about two hours of detection. It replaced compromised security credentials and patched the vulnerability it identified.
Gnosis Pay said its enterprise/white-label platform was not part of the affected system. It said affected customers were emailed with details of the information exposed about them, and that the company was contacting partners and relevant data protection authorities.
The company said customer funds were not affected. Reports say 3D Secure was made mandatory for online card payments after the incident, and that this measure would remain until the affected system is decommissioned on 20 December 2026.

**How it worked**
The attack vector has not been disclosed. Gnosis Pay has said only that there was unauthorized access to the legacy card system and that it replaced compromised credentials and patched a vulnerability. The sources do not say whether the entry point was phishing, leaked credentials, API abuse, misconfiguration, malware, or insider access.
The reported exposure is customer data rather than an on-chain asset drain. No stolen token, blockchain transaction, or wallet-level theft is identified in the available reporting.

**Where the money went**
No fund movement, theft, mixer, bridge, or exchange flow is reported. No frozen or recovered assets are reported. The company says customer funds were not affected.

**The response**
According to the company, it contained the incident within about two hours, replaced compromised credentials, patched the vulnerability, and emailed affected customers with details of the exposed data. It also made 3D Secure mandatory for online card payments, contacted partners and data protection authorities, and kept extra safeguards in place until the system is decommissioned on 20 December 2026. The disclosure came about three days after detection.

**Impact**
Reported impact is limited to customer data exposure in the legacy consumer card system. The company says customer funds were not affected. The sources do not quantify the number of affected users, market reaction, or user sentiment. Users may face elevated phishing risk, which the company and secondary reports have warned about.

**Timeline**
- 2026-11-03 Gnosis Pay detects unauthorized access to the legacy system behind its branded consumer cards, according to the company.
- 2026-11-03 Containment begins within about two hours of detection, according to the company. Compromised credentials are replaced and the vulnerability is patched.
- 2026-11-06 Gnosis Pay publicly discloses the data breach, saying customer funds were not affected and affected users would be emailed.
- 2026-12-20 Scheduled decommissioning of the affected B2C/consumer-card system, as previously announced by the company.

**How to protect yourself**
- Watch for phishing emails, texts, or calls that reference the breach or your card. Gnosis Pay's warnings to users point to this risk.
- Verify any notice from Gnosis Pay through official channels before acting, and do not share credentials, one-time codes, or card details.
- Use 3D Secure or equivalent authentication for online card payments where available, as the company has now required.
- Watch for scheduled shutdowns of legacy systems, which can leave older infrastructure in service longer than planned and create risk.
- Limit personal data shared with card and fintech providers, and monitor account activity for unfamiliar transactions.

**Still unknown**
- Number of customers affected and the exact data fields exposed.
- The entry point, attacker identity, and whether the attack was phishing, credential theft, API abuse, misconfiguration, malware, or insider access.
- How long unauthorized access lasted before detection on 3 November 2026.
- Whether any exposed data has been published, sold, or used for fraud.
- Whether a regulator or law enforcement has opened a formal investigation.
- Whether any wallet addresses, on-chain activity, or fund movements are linked to the incident. None are reported in the available sources.

**Sources**
- Gnosis Pay blog https://gnosispay.com/blog
- PANews report https://panews.io/articles/01a1b15d-8c9c-7231-a3e2-3182e8677d73
- DefiPrime: Gnosis Pay legacy card data breach https://defiprime.com/gnosis-pay-legacy-card-data-breach
- PrimeXBT: Gnosis Pay says hackers accessed customer data through its branded card system https://primexbt.ch/news/gnosis-pay-says-hackers-accessed-customer-data-through-its-branded-card-system/
- CoinGape: Gnosis Pay data breach, hackers steal user information https://coingape.com/gnosis-pay-data-breach-hackers-steal-user-information/
- Odaily newsflash 531787 https://www.odaily.news/en/newsflash/531787
- TechFlow Post newsletter 143429 https://techflowpost.com/en-US/newsletter/143429
- HeadTopics: Gnosis Pay data breach exposes Visa cardholders https://us.headtopics.com/news/gnosis-pay-data-breach-exposes-visa-cardholders-in-major-89621074
- Crypto.news: Gnosis Pay customer data breach, legacy card system https://crypto.news/gnosis-pay-customer-data-breach-legacy-card-system/
- Binance Square: Gnosis Pay reports data breach in branded card B2C system https://www.binance.com/en/square/post/11-06-2026-gnosis-pay-reports-data-breach-in-branded-card-b2c-system-platform-set-to-shut-down-on-december-20-2026-385378384860516
- Pluang: Gnosis Pay requires 3D Secure after data breach https://pluang.com/en/news-feed/gnosis-pay-mewajibkan-3d-secure-setelah-pelanggaran-data
- U.Today: Gnosis Pay breach exposes user data, triggering phishing alerts https://u.today/gnosis-pay-breach-exposes-user-data-triggering-immediate-phishing-alerts
- Odaily newsflash 531781 https://www.odaily.news/en/newsflash/531781
- Lookonchain feed 80948 https://www.lookonchain.com/feeds/80948
- BBX news 3173165 https://bbx.com/news-detail/3173165

---
VaultX: free crypto news and intelligence, https://vaultx.llc