Gnosis Pay breach exposes card details, personal data and crypto wallet information

The crypto debit card provider said customer funds remained safe despite the exposure of sensitive financial and personal information.

Crypto-linked Visa debit card provider Gnosis Pay disclosed a security breach on Friday that exposed customers’ payment card details, addresses and cryptocurrency wallet addresses.

Gnosis Pay said it detected unauthorized access to its legacy consumer card system on Nov. 3 and began containing the breach within two hours. The company said customer funds and its separate enterprise platform, which powers white-label card programs, were unaffected.

According to breach notifications reviewed by Cointelegraph, the company identified exposed information including full payment card numbers, expiration dates, CVV codes, customer names, addresses and wallet addresses linked to affected accounts. The compromised data also included email addresses, phone numbers, nationalities and, in some cases, banking details such as IBAN and BIC information.

Gnosis Pay customer shares a breach notification detailing exposed personal and financial data. Source: Lefteris Karapetsas

One notification also confirmed that the customer’s card was canceled on Nov. 3, with no suspicious transactions or movement of funds detected.

Gnosis Pay said it replaced compromised security credentials, addressed the vulnerability and made 3D Secure verification mandatory for online payments until the legacy system’s planned retirement on Dec. 20. It also warned customers phishing attempts using their personal or transaction details and said it was arranging monitoring for potential misuse of the stolen data.

According to data from OpenRate, a third-party platform tracking crypto card activity, Gnosis Pay had around 2,400 daily active cardholders and processed $263,200 in transactions over the 24 hours.

The company did not disclose how many customers were affected and did not immediately respond to Cointelegraph’s request for .

Magazine: Binance hackers raced to move billions before it could be frozen

Binance hackers had 8-week intrusion window before $6.3B exploit: SEAL

Binance, Deribit revoke SignalPlus API keys after fake Teams invite attack

Fed, OCC check US banks after Binance hack as experts flag security risks

Binance hackers had 8-week intrusion window before $6.3B exploit: SEAL

Binance, Deribit revoke SignalPlus API keys after fake Teams invite attack

Fed, OCC check US banks after Binance hack as experts flag security risks