Gnosis Pay discloses customer data breach: user funds unaffe
Gnosis Pay disclosed that on November 3 its monitoring system detected unauthorized access to the system supporting its branded cards, resulting in the leakage of some customer information; user funds were unaffected. The team began handling the incident within two hours, replaced security credentials and fixed the vulnerability, mandatory 3D Secure was enabled for online card payments, and the B2C system involved is planned to be decommissioned on December 20.
Event timeline
- [11-06 14:57] Gnosis Pay consumer card system suffered a data breach, user funds unaffected (PANews)
- [11-06 14:58] User funds unaffected, Gnosis Pay consumer card system suffered a data breach (Odaily Planet Daily)
- [11-06 15:05] Gnosis Pay discloses customer data breach, says user funds unaffected (Wu Shuo)
Background and impact
On November 6, PANews, Odaily Planet Daily and Wu Shuo successively reported that Gnosis Pay disclosed a customer data breach incident on its official blog. According to its statement, the monitoring system detected on November 3 unauthorized access to the system supporting Gnosis Pay branded cards, causing some customer information to be leaked; user funds were unaffected. The three sources reported at 14:57, 14:58 and 15:05 respectively, and their statements on the detection time and cause of the leak were basically consistent.
Regarding the response process, Gnosis Pay said the team began handling the incident within two hours of detection, had replaced the affected security credentials and fixed the vulnerability. The platform has sent emails to all affected users informing them of the specific leaked information, and has mandatorily enabled 3D Secure verification for all online card payments; the relevant measures will continue until the B2C system is decommissioned as planned on December 20. Wu Shuo also mentioned that the platform has strengthened monitoring of bank card and wallet transactions.
Regarding the scope of impact, all three sources said that the enterprise platform supporting all of its white-label card programs was unaffected. There is a slight discrepancy in the description of the system involved: PANews and Odaily called it the system supporting Gnosis Pay branded cards (B2C business line), while Wu Shuo called it the "legacy system" and said the incident only involved the consumer-facing B2C payment card system. These statements were not explicitly denied by other sources, and the reports did not provide further explanation on this point.
In terms of the nature of the incident, the core of this disclosure is customer information rather than assets. Gnosis Pay emphasizes that user funds were unaffected, but users still need to guard against phishing risks after the information leak. The official notice reminds users to be wary of phishing messages and never disclose mnemonic phrases, private keys, PINs or full card numbers. For users of crypto payment cards or trading platforms, when conducting account operations they should rely on official channels; for example, when doing Huobi HTX registration APP download, Zhima Gate.io registration APP download, Bitget registration APP download, Binance registration APP download, or OKX registration APP download, verify the domain and source, and avoid being redirected via emails or social links. The time point to watch going forward is the decommissioning arrangement of the B2C system on December 20, and whether the platform releases further statements on the scope of impact and the number of affected users.
FAQ
### Are user funds safe in this incident?
Gnosis Pay says user funds were unaffected and that what leaked was some customer information. The three sources are consistent on this point, but none disclosed the specific number of affected users or the types of information; users can pay attention to the explanation in official emails.
### What should I do after receiving the notification email?
Officials said they have sent emails to all affected users informing them of the specific leaked information, and remind them to be wary of phishing messages and never disclose mnemonic phrases, private keys, PINs or full card numbers. Any email or link requesting the above information should be considered suspicious.
### What time points should be watched going forward?
Officials said the measure of mandatorily enabling 3D Secure verification for all online card payments will continue until the B2C system is decommission