On November 3, monitoring systems at the crypto debit card provider detected unauthorised access to the B2C platform that runs Gnosis Pay-branded cards. Certain customer information was exposed, while user funds were not affected.

Containment began within two hours of detection, the affected credentials were replaced and the vulnerability was addressed. The enterprise platform that powers the company's white-label card programmes was not affected.

The breached system was already scheduled for retirement on December 20, 2026. Until then, 3D Secure verification is mandatory for all online card payments and monitoring of card activity and wallets has been increased.

Every affected customer was emailed a list of exactly what data was taken, and the breach was reported to partners, the card issuer and data protection authorities. Users are warned to expect phishing that may include their real details or purchases.