---
title: Gnosis Pay: unauthorized access on Nov 3 hit the legacy system behind its branded cards; enterprise white-label platform untouched | ctxsec
url: https://ctxsec.com/items/gnosis-pay-legacy-b2c-card-breach-nov-6
description: "Gnosis Pay says monitoring caught unauthorized access on Nov 3 to the system powering Gnosis Pay-branded cards (its B2C line), exposing certain customer information. Containment began within two hours; credentials were replaced and the vulnerability fixed. The B2C stack was already set to retire Dec 20. The enterprise platform that powers white-label card programmes was not affected, and the company says customer funds were not. Affected customers were emailed with exactly what was taken from their account; reporting went to partners, the card issuer and data-protection authorities."
status: "official (Gnosis Pay blog, Nov 6; incident detected Nov 3); enterprise white-label platform not affected; funds not affected"
published: 2026-11-06
---

> Gnosis Pay says monitoring caught unauthorized access on Nov 3 to the system powering Gnosis Pay-branded cards (its B2C line), exposing certain customer information. Containment began within two hours; credentials were replaced and the vulnerability fixed. The B2C stack was already set to retire Dec 20. The enterprise platform that powers white-label card programmes was not affected, and the company says customer funds were not. Affected customers were emailed with exactly what was taken from their account; reporting went to partners, the card issuer and data-protection authorities.

[← Cybersecurity News](/news) · [markdown](/items/gnosis-pay-legacy-b2c-card-breach-nov-6.md)

official (Gnosis Pay blog, Nov 6; incident detected Nov 3); enterprise white-label platform not affected; funds not affected

2026-11-06

### Gnosis Pay: unauthorized access on Nov 3 hit the legacy system behind its branded cards; enterprise white-label platform untouched

- **Defenses now:** stepped-up monitoring of card and wallet activity; 3D Secure mandatory for all online card payments until B2C retirement.
- **Customer advice (official):** treat unexpected email/SMS/calls about Gnosis Pay, Partner Apps or the card as phishing even if they quote real details; never share seed phrases, private keys, PIN or full card number; account changes only inside the official web app or Partner App.
- Customer notices and secondary reporting (e.g. Protos) indicate some affected users were told that names, shipping/home addresses, card numbers and linked wallet addresses were among the data types accessed — scope varies by account.

Sources: [Gnosis Pay: Data breach on the legacy system powering Gnosis Pay-branded cards (Nov 6)](https://gnosispay.com/blog/data-breach-legacy-system-gnosis-pay-branded-cards) · [Gnosis Pay on X (Nov 6)](https://x.com/gnosispay/status/2118713486616227862)