Gnosis Pay Breach: The Legacy Card System Retires 44 Days After Disclosure

Gnosis Pay disclosed on 6 November that unauthorised access to the legacy system behind its branded cards exposed customer information. Its breach notice is short enough to read in four minutes, and almost every line in it is a number with a date attached: detection on 3 November, containment inside two hours, disclosure three days later, retirement of the affected platform on 20 December.

The sequence runs like this. Monitoring systems detected the access on 3 November on the platform powering Gnosis Pay-branded cards, the company’s consumer line.

Containment began within two hours of detection, credentials were replaced, and the vulnerability was closed. Gnosis Pay says customer funds were not affected, and that the enterprise platform running its white-label card programmes was never in scope.

The public post came three days later, on 6 November. The affected backend was already scheduled for retirement on 20 December 2026, forty-four days after the notice and forty-seven after the intrusion began.

Two hours, three days, 1,128 hours

Against an ordinary incident timeline, the containment number is the strong one. Two hours from detection to an active response is a monitored system doing what monitoring is for. The company caught the access itself rather than learning about it from a fraud report, a cardholder complaint or a threat-intelligence tip.

The disclosure number is the arguable one. Seventy-two hours is exactly the outer limit UK data protection law sets for telling a regulator about a reportable breach. Article 33 of the UK GDPR requires notification to the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”.

That clock runs to the regulator, not to the public, so publishing on day three is neither early nor late by itself. It does mean the company had almost no margin if the notification and the blog post went out in the same window.

Gnosis Pay says it is “communicating with the applicable data protection authorities and with our card issuer.” The notice does not name those authorities, does not say when they were contacted, and does not say whether a formal notification has been filed or is still being assembled.

Under Article 33, a controller that overruns the 72 hours has to explain the delay in a phased notification. A controller that files inside the window says nothing at all. Silence here is consistent with a filing on time, and it does not prove one.

The notice lists actions, not the contents of the files

Read closely, the post is an inventory of things Gnosis Pay is doing rather than an inventory of what was taken. It confirms the detection date, containment inside two hours, credential replacement and a scope limited to the consumer card platform.

It also confirms funds unaffected, mandatory 3D Secure on all online card payments until retirement, an email to every affected customer, notification of partners, regulators and the card issuer, and extra monitoring of card activity and wallets.

What it withholds is the shape of the exposure. There is no count of affected customers. No list of data fields appears in the public text, which says only that the breach “resulted in the exposure of certain customer information.”

Nothing in it addresses whether full card numbers, expiry dates or security codes were in scope. Nothing says whether cards will be reissued, whether law enforcement is involved, or what a cardholder should expect on 21 December.

That gap is a choice rather than an oversight. The company put the specifics in individual emails, and its own account on X states: “Everyone affected was sent an email today with full information.” Account-level disclosure is more useful to the person who needs it and less useful to everyone else.

We had a data breach affecting the system powering Gnosis Pay-branded cards (our B2C business line) that resulted in the exposure of certain customer information. Everyone affected was sent an email today with full information. We deeply regret that this happened.

— Gnosis Pay (@gnosispay) November 6, 2026

It also means nobody outside can size the incident from the notice alone. Any figure circulating that does not come from Gnosis Pay or a regulator is an estimate, and most of the estimates published in the first 24 hours were assembled from a single sentence.

One implication follows. If every affected customer was emailed, then an account that received nothing was outside the exposed set. The notice does not say that in as many words, and it does not describe how the affected accounts were identified.

Five months earlier, the damage was to funds rather than data

This is the second Gnosis Pay security disclosure of 2026, and the first was worse in the way that matters to a wallet holder. In June, the company says it “migrated everyone to a new card Safe following a security incident.” Most balances moved across automatically.

Some did not, and those accounts were left holding funds in an old Safe that had to be withdrawn manually. The recovery page for that first incident is still live, and its warnings are blunter than anything in this week’s notice.

“Don’t send funds to your old Safe address. If your old Safe was affected by the incident, anything sent there is lost.” The page tells users to connect the wallet that owns the old Safe, hold a little xDAI for gas, and withdraw to a Gnosis Chain address. It carries no deadline, and it was last updated a month ago.

The two incidents sit on different layers, which is why the fixes look so different.

That last row is the part worth pausing on. Retiring a backend on 20 December closes a door. It does not un-copy a customer list. The scheduled shutdown removes the attack surface that produced this incident, and it does nothing about the data already outside the building.

Whether that matters depends on the fields in the emails, which the public still cannot see.

Why every online payment now goes through 3D Secure

For cardholders, the most immediate change is friction. Gnosis Pay has made 3D Secure mandatory for all online card payments, and says the requirement stays until the consumer system retires. Each online purchase now routes through the issuer’s authentication step before it completes.

The reason is mechanical. A card number on its own can be used for a card-not-present transaction. A 3D Secure challenge asks the cardholder to authenticate with the issuing bank, so a stolen number without the account holder’s participation usually fails.

That is why issuers reach for it after any event that may have exposed card credentials, and why it is a mitigation rather than a fix. What the notice does not change is worth stating as plainly as what it does.

Gnosis Pay has not told cardholders to replace their cards, has not suspended spending, and has not described changes to in-person or ATM use. The 3D Secure requirement is scoped to online payments.

The advice in the post targets a second risk, which is social rather than technical. “Be suspicious of any unexpected email, text, call or letter about Gnosis Pay, a Partner App or your card, even if it includes your real details or a real purchase. Don’t click its links.”

The company says it will never ask for a seed phrase, private keys, PIN or full card number, never ask anyone to “re-verify” identity by email or text, and never ask a customer to move funds by phone or message. Any real change, it says, happens inside the official app.

That warning carries more weight in a leak that may include names, contact details and links between an account and a wallet. A convincing message needs one true detail, and an attacker working from account records has several.

Gnosis Pay is a UK card company; GNO is a separate token

Three names get used interchangeably in coverage of this story, and they are not the same thing. Gnosis Pay is the trading name of Gnosis Pay Co Ltd, a UK-registered company, number 14919639.

The card is issued by Monavate Limited under licence from Visa Europe, and Monavate is authorised by the Financial Conduct Authority as an electronic money institution, firm reference 901097. Gnosis Pay’s Visa relationship dates to May 2024, when the two announced a collaboration.

Those relationships explain the notification list in the post: card issuer, partners and data protection authorities, in that order of operational urgency.

GNO is a different object. CoinGecko priced GNO at $112.29 at 18:57 UTC on 7 November 2026, down 1.37% over 24 hours, on a market capitalisation of $296.4 million and 24-hour volume of $996,361. That volume works out to 0.34% of market cap, a thin print for an asset of that size. Bitcoin moved 0.01% over the same window.

Nothing in the breach notice mentions Gnosis Chain or GNO. The one place the two touch is plumbing: the legacy Safe recovery tool asks users for a Gnosis Chain address and xDAI for gas, because the card product settles there.

A connection in the stack is not evidence that the token carries the company’s liability, and the price data does not suggest the market treated it that way. A 1.37% decline on under a million dollars of volume is inside the normal daily range, and the flat bitcoin print gives no cover for calling it a breach reaction.

What would confirm the size of this

Four signals will matter more than the current text. The first is a number. A customer count, a category list or a regulator’s account of the incident would replace the phrase “certain customer information” with something checkable.

The second is the card issuer. Monavate sits between Gnosis Pay and the Visa network, and any decision to reissue cards would surface through it rather than through a blog post. A reissue programme would also imply that card credentials, not just contact details, were in scope.

The third is phishing volume. Exposed names, addresses and wallet links are the raw material for convincing messages, and the withdrawal tool’s warning about funds sent to old Safes gives an attacker a plausible script.

Breaches of this type have clustered lately. Chainalysis disclosed on 6 November that live tokens for all of its users were exposed in a separate incident, and the comparison that matters is disclosure practice, not scale.

The fourth is the retirement date itself. If the consumer platform goes dark on 20 December as scheduled, the attack surface closes on time. What replaces it for existing cardholders remains unstated, and the notice does not treat that as part of the incident.

What this article cannot establish is the size of the exposure. The number of affected accounts, the exact fields taken, whether the card numbers were usable and whether a supervisory authority has opened an inquiry are all outside the public record.

Those gaps are not a reason to assume the worst or the best. They are the reason the emails, not the blog post, are the document that matters to anyone who held one of these cards.

Frequently Asked Questions

This article is based on Gnosis Pay’s published notice of 6 November 2026 and its official account on X, plus the company’s help-centre documentation for the June 2026 incident and live CoinGecko pricing. No affected customer data was reviewed.