Gnosis Pay data breach exposes customer info; funds unaffected

Judgment

Gnosis Pay's operators must decide whether retiring the legacy card system on Dec. 20 actually closes the exposure, and customers must decide whether to keep using the card while 3D Secure is compulsory — trading checkout convenience for the assurance that funds stayed untouched.

Basis

Gnosis Pay disclosed that unauthorized access to its legacy debit card system was detected on Nov. 3; the company said it contained the incident within two hours, replaced compromised security credentials and addressed the vulnerability. It stated customer funds were not affected and that its enterprise platform powering white-label card programs was untouched. Until the affected system is retired on Dec. 20, 3D Secure verification is mandatory for online card payments. The mechanism the article points to is inherited infrastructure: crypto card providers lean on third-party and legacy systems, so an intrusion into a management layer exposes customer information even when balances are held elsewhere. Comparable episodes are given — Based said an attacker reached an internal dashboard managing its Visa card program on Oct. 5 with data exposed but funds not accessed; in August a vulnerability in Rain's Solana card infrastructure allowed unauthorized withdrawals from card balances of Tria and Avici users; Revolut said a fraudulent request from a legitimate government email domain yielded sensitive customer information.