Gnosis Pay has confirmed that some customer information was exposed after unauthorized access to its legacy business-to-consumer (B2C) card system. The cryptocurrency payment card provider said it detected the incident on November 3 and began containment measures within two hours.

According to Wu Blockchain, the incident involved Gnosis Pay's older B2C card system. The company said it replaced compromised credentials and addressed the vulnerability after identifying the unauthorized access. Customers whose information was affected have also been notified.

Gnosis Pay emphasized that the security incident did not affect customer funds or its enterprise white-label card platform, the offering through which other businesses can issue cards under their own branding. The disclosure draws a clear distinction between the compromised legacy system and the company's enterprise offering, which it said remained unaffected. It also reflects a security consideration specific to crypto payment card providers: even when customer funds remain untouched, card systems hold personal information that can be exposed through unauthorized access.

Gnosis Pay Strengthens Card Security Measures

In response to the exposure, Gnosis Pay has introduced additional security measures covering card and wallet activity. The company has increased monitoring across both areas as part of its post-incident response.

It has also made 3D Secure verification mandatory for all online card payments. 3D Secure is a card-industry authentication standard designed to add a verification step to online transactions, and the requirement now applies to every online payment made with Gnosis Pay cards. The measure forms part of the safeguards announced after the unauthorized access was detected.

The company said its response included replacing compromised credentials, fixing the identified vulnerability and notifying customers whose information was affected. Containment began within two hours of the incident being detected on November 3.

Legacy Card System Set for Retirement

The affected B2C card system is a legacy platform that Gnosis Pay already planned to retire. The company has scheduled its retirement for December 20, establishing a defined timeline for the system's removal.

The disclosure does not indicate that customer funds were compromised or that the enterprise white-label card platform was accessed. Gnosis Pay's stated impact remains limited to the exposure of some customer information through unauthorized access to the legacy B2C system.

For affected customers, Gnosis Pay has confirmed notification and outlined the additional safeguards introduced after the incident. These include expanded monitoring of card and wallet activity and mandatory 3D Secure verification for every online card payment. With the legacy platform's removal scheduled for December 20, that date now serves as the defined endpoint for the system involved in the incident, while the expanded monitoring and authentication requirements remain the safeguards in place for Gnosis Pay cardholdersn
Source: Hokanews