The Gnosis Pay data breach disclosed on November 6, 2026 exposed customer information from its legacy consumer card system, but the company said customer funds were unaffected . Security monitoring detected unauthorized access on November 3, and containment began within two hours. Extra payment checks will remain until the service’s previously scheduled December closure.
Key takeaways
The breach affected consumer cards, not Gnosis Pay’s enterprise platform.
Affected cardholders received account-specific notifications by email.
Online card purchases now require 3D Secure verification.
Branded card services end on December 20, 2026.
Scope and response to the Gnosis Pay data breach
The intrusion affected the legacy system serving Gnosis Pay -branded consumer cards. The enterprise white-label platform , which supports card programs for other businesses, was not affected.
Gnosis Pay said its security team started containment within two hours of detecting the unauthorized access on November 3. It subsequently replaced affected security credentials and fixed the vulnerability.
The company notified its partners and said it was communicating with the relevant data protection authorities and its card issuer. Monavate Limited, the issuer regulated by the UK’s Financial Conduct Authority, continues to operate.
Mandatory payment checks and closer monitoring
Gnosis Pay has made 3D Secure , an additional verification step for online purchases, compulsory for every online card payment until the consumer system closes.
Card transactions and wallets are also receiving closer monitoring for fraud and attempts to access funds. According to the company, a comprehensive review is underway, with lessons being applied system-wide and specialist monitoring arranged to detect misuse of the exposed information.
Everyone affected by the Gnosis Pay data breach received an email on November 6 explaining which information had been taken from their account, along with account-specific recommendations. Its support team is prioritizing those customers.
Customer guidance against phishing
Rather than clicking links in unsolicited messages, customers were advised by Gnosis Pay to access its official web app or their partner app directly. The guidance cautioned that fraudulent communications might include accurate personal information or mention a legitimate purchase.
This warning applies to unexpected emails, texts, phone calls and letters referencing Gnosis Pay, partner applications or payment cards. According to the company, neither it nor its partners would ever ask for seed phrases, private keys, PINs or full card numbers .
Additionally, customers would never be asked to verify their identity again via email or text, nor would they be instructed to send funds based on a message or call. Anyone with concerns was told to reach out to help@gnosispay.com.
December closure was scheduled before the breach
The consumer platform’s retirement predates the November incident. According to a notice published on September 21, branded card services will cease at 23:59 UTC on December 20, 2026 .
At that point, transaction authorization will end for both physical and virtual cards. Withdrawal functionality will remain available through the web app, and customers will retain ownership of assets in their self-custodial Safe accounts.
To keep using a card beyond that point, customers must enroll in a partner program under revised terms, though this step is not mandatory since branded cards will become inoperative either way. Before the shutdown, the notice instructs customers to download their transaction records and revise any recurring merchant payment arrangements.
Standard cardholder support is set to conclude on June 18, 2027, while assistance for refunds, disputes and chargebacks will remain available through June 12, 2028.
Earlier exploit involved the Zodiac framework
In a separate incident from June, roughly $1.5 million in digital assets was compromised through a card-account exploit. Gnosis Pay’s July postmortem traced the cause back to a vulnerability within the Zodiac smart contract framework.
The company said customers affected by the June exploit had been fully reimbursed.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
