Gnosis Pay confirms card data breach, warns users of fake support phishing
In brief
- Gnosis Pay says a November 3 breach exposed retail Visa debit cardholder data.
- Compromised keys: Gnosis Pay says it cut off access within two hours and funds weren't affected.
- The legacy B2C card system involved is scheduled for full shutdown on December 20.
- Scammers are already posing as official customer support, Gnosis Pay's phishing alert warns.
What Gnosis Pay says happened
The affected system was already on its way out. Gnosis Pay told users the legacy platform was being prepared for retirement, with a full shutdown scheduled for December 20. Until it goes offline, the company said it's operating in emergency mode (increased transaction monitoring, plus mandatory 3D Secure verification for all online payments).
According to Gnosis Pay's statement as reported by U.Today, the attackers obtained data only. The company said it has finished emailing affected users with a detailed list of the exposed data. U.Today's report doesn't cite any loss figure or name a responsible party.
The rest of the business wasn't touched, per the company. Gnosis Pay said its enterprise and white-label B2B platform is running normally, and card issuer Monavate Limited (which is regulated by the UK Financial Conduct Authority) continues to operate.
The phishing warning
The more immediate risk now is social engineering. Gnosis Pay issued a phishing alert saying scammers are already posing as official customer support.
The company's message to cardholders was blunt:
“we and our Partner Apps will never ask”
That covers seed phrases, private keys, PINs and full card numbers, none of which Gnosis Pay or its Partner Apps will request to verify or cancel transactions. The company also said account changes are legitimate only when users make them directly within the official app, so any "support agent" asking you to do otherwise isn't one.
U.Today's read on the pattern
U.Today, in its own analysis, placed the incident alongside recent leaks tied to Ledger, Trezor, SafePal and Keystone. The outlet argued that attackers increasingly go after the traditional fiat infrastructure linking digital assets to the real world, rather than blockchains or smart contracts.
If U.Today is right, the weak spot for crypto card users isn't the chain.
It's the card rails and customer databases sitting next to it, and the phishing that follows once that data is out.
Frequently asked questions
Were Gnosis Pay user funds affected by the breach?
Gnosis Pay said user funds were not affected. According to the company's statement as reported by U.Today, the attackers obtained data only, and its security team cut off access via the compromised keys within two hours.
How can Gnosis Pay users spot phishing after the breach?
Gnosis Pay said it and its Partner Apps will never ask for seed phrases, private keys, PINs or full card numbers to verify or cancel transactions. It also said account changes are legitimate only when users make them directly within the official app.
