Gnosis Pay tightens card security after customer data breach in legacy debit system
Unauthorized access to a legacy card system has pushed Gnosis Pay to impose extra payment checks while it prepares to retire the affected platform on Dec. 20. The incident exposed some customer information tied to Gnosis Pay-branded debit cards, but the company says customer funds and its white-label enterprise platform remain unaffected.
Highlights
- Gnosis Pay detected unauthorized access to its legacy debit card system on Nov. 3, containing the breach within two hours and updating security credentials.
- The breach exposed some Gnosis Pay customer data but did not affect customer funds or its enterprise white-label card platform.
- Gnosis Pay made 3D Secure mandatory for online payments until Dec. 20 as it retires the legacy system, addressing sector-wide vulnerabilities seen in crypto card providers.
Incident response and security measures
As reported by The Block, citing Gnosis Pay, unauthorized access to its legacy system powering Gnosis Pay-branded debit cards was detected on Nov. 3, prompting the company to contain the incident within two hours. It said compromised security credentials were replaced and the vulnerability was addressed after the breach was identified.The company says the incident exposed certain customer information, but did not affect customer funds. Gnosis Pay also says its enterprise platform, which powers white-label card programs, was not touched by the breach.
To reduce near-term risk, Gnosis Pay has made 3D Secure verification mandatory for online card payments until the affected system is retired on Dec. 20. The move adds an extra authentication layer as the company phases out the legacy infrastructure.
Broader pressure on crypto card providers
The breach highlights a wider operational challenge for crypto card providers, which increasingly rely on third-party infrastructure and older systems that can create security vulnerabilities. Recent incidents across the sector have exposed cardholder information and, in some cases, involved exploits affecting funds held in card accounts.Separately, Revolut says an unauthorized third party used a fraudulent request sent from a legitimate government email domain to obtain sensitive customer information. The data potentially included account statements, identity documents and Bitcoin transaction histories, while customer funds and systems were unaffected.
Banks’ bare metal recovery planning was the focus of our earlier coverage, highlighting calls for lenders to build independent fallback systems to keep critical services running if primary technology is compromised. We also noted regulators’ growing concern that AI is increasing the scale and complexity of cyber attacks, prompting tougher expectations around cyber resilience and end-to-end recovery thinking across the financial system.
Latest Company News News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
