2026 Gnosis Pay — legacy card-system breach; PAN, CVV, wallets
Data compromised
Customer emails (Cointelegraph / CoinDesk): full card numbers, expiry, CVV, names, home addresses, linked wallet addresses; in some cases email, phone, nationality, IBAN/BIC. Fields varied by customer. Census unpublished. recordsAffected 0.
Technical writeup
Official blog 6 Nov 2026. 3-D Secure mandatory on online card payments until B2C retirement. Public post does not list fields; field list is from customer emails reported by trade press.
Root cause
Unauthorised access on 3 November 2026 to the legacy system behind Gnosis Pay-branded B2C cards. Contained within two hours. Credentials replaced and the vulnerability addressed. Enterprise white-label platform not affected. B2C system already due to retire 20 December 2026. Funds not affected, the company says.
References
- https://gnosispay.com/blog/data-breach-legacy-system-gnosis-pay-branded-cards
- https://cointelegraph.com/news/gnosis-pay-breach-exposes-card-details-personal-data-crypto-wallet-information
- https://www.coindesk.com/business/2026/11/07/gnosis-pay-breach-exposes-card-numbers-home-addresses-and-linked-crypto-wallets