Gnosis Pay disclosed a customer data breach on November 6 after detecting unauthorized access to its legacy consumer card system. The company said customer funds and its enterprise platform remained unaffected, and that tighter payment controls will stay in place until December 20. The announcement came weeks after Gnosis Pay had already told customers that the consumer card service would close.

According to the company's public statement, the intrusion was detected on November 3, and security staff began containment within two hours — three days before the breach was disclosed publicly. Affected credentials were replaced and the exploited vulnerability was fixed, the company said. Gnosis Pay has not identified the attacker.

The company announced the incident in a post on X on November 6:

We had a data breach affecting the system powering Gnosis Pay-branded cards (our B2C business line) that resulted in the exposure of certain customer information. Everyone affected was sent an email today with full information. We deeply regret that this happened. While funds…

— Gnosis Pay 💳 (@gnosispay) November 6, 2026

What Information Was Exposed in the Breach

Gnosis Pay stated that the breach occurred in the infrastructure behind its branded consumer card program, the company's B2C business line. The separate enterprise product line, which Gnosis Pay uses to power card programs for other companies, was not implicated.

Each affected individual received an email on November 6 describing the information compromised from their account. The public notice did not disclose how many individuals were affected or which categories of information were exposed, and the company did not provide a timeline for publishing additional technical details. Gnosis Pay said it notified its business partners, the card issuer, and the relevant data protection authorities. Under the European Union's General Data Protection Regulation, organizations generally must report personal data breaches to the competent supervisory authority within 72 hours of becoming aware of them — a requirement that shapes breach response across Europe's payment sector.

How Gnosis Pay Tightened Card Security

In response to the incident, the firm implemented the 3D Secure protocol, which requires verification of a user's identity before a transaction is completed. The policy is expected to remain in place until the legacy consumer system is shut down.

The measures drew objections from some consumers following the leak, with users asking questions about accountability and the possibility of phishing attacks through emails containing leaked data. Gnosis Pay cautioned that such emails may reference personal data or legitimate past transactions. It advised customers not to click links in emails, text messages, or other messaging applications, and to access the service only through the official web app or a partner app.

The company said it never asks for seed phrases, private keys, PINs, or full card numbers through messages, and warned users against requests to move funds or repeat identity verification through unsolicited contact. Those cautions have a long shelf life: personal data leaked in a breach can resurface in phishing attempts well after the incident itself, and customers will still be using the web app for withdrawals, history exports, and recurring-payment updates throughout the wind-down, whose support windows run into 2027 and 2028.

When Will the Consumer Card Service Close

The wind-down of the consumer card program was set in motion before the breach occurred. In a formal notice published on September 21, Gnosis Pay said branded physical and virtual cards would stop authorizing transactions after 23:59 UTC on the same day.

The web app will cease offering services other than withdrawals. Users retain ownership of the funds in their self-custodial Safe accounts, which no longer depend on the availability of the card program.

Users may optionally join a partner program to keep using a card, a step that requires accepting new terms. Either way, the existing Gnosis Pay-branded cards will stop functioning.

The notice urges users to export their transaction histories and update their recurring payment information. General cardholder support will end on June 18, 2027, while refund and chargeback assistance will run until June 12, 2028.

How the November Breach Differs From June's Exploit

The disclosure marks the second security incident to affect the card platform this year. In June, the card-wallet system suffered a separate attack. In a July 3 post-mortem, Gnosis Pay acknowledged that a vulnerability in Zodiac modules allowed hackers to extract nearly $1.5 million worth of cryptocurrency. The flaw stemmed from incorrect signature validation in the card-safe software. The company said it took the losses in stride and rebalanced the funds for customers.

Set side by side, the two incidents point to different kinds of exposure: June's was an on-chain exploit with stolen crypto at stake, while November's centers on customer information — shifting the open questions from asset recovery to data protection.