Gnosis Pay's public notice said only that certain customer information was exposed. The notices sent to affected customers listed full card numbers with CVV codes alongside the wallet addresses linked to their accounts, according to notifications reviewed by Cointelegraph.
Gnosis Pay told customers on Friday that a breach of the system behind its branded payment cards had exposed "certain customer information." The notices it sent to those customers were considerably more specific. According to breach notifications reviewed by Cointelegraph, they listed full payment card numbers, expiration dates and CVV codes, customer names and home addresses, and the crypto wallet addresses linked to the affected accounts.
The notifications also listed email addresses, phone numbers and nationalities, and in some cases IBAN and BIC banking details, Cointelegraph reported, with the exposed fields varying by account. Gnosis Pay has published no field list of its own and did not immediately respond to the publication's request for comment.
The company's own account of the incident says its monitoring systems detected unauthorized access to the legacy system powering Gnosis Pay-branded cards on November 3, and that containment began within two hours. Compromised credentials were replaced and the vulnerability was addressed. Customer funds were not affected, and the separate enterprise platform that runs the company's white-label card programs was outside the scope of the breach. Affected customers were emailed on November 6, the day the post went up.
The post does not name a single data field. BlockchainReporter noted on Saturday that the public text leaves open whether card numbers, expiration dates or security codes were involved, and that no count of affected customers has been published by the company or a regulator.
One affected customer has publicly described part of what was taken from his own account. Lefteris Karapetsas, the founder of Rotki, said his name, address, card number and wallet addresses were among the data taken, according to Cointelegraph and ForkLog. Cointelegraph also reported that one notification confirmed a customer's card had been canceled on November 3 with no suspicious transactions or movement of funds detected.
A full card number with its expiration date and CVV is the set a merchant accepts for a payment where the card is not present, and losing it normally means a reissued card. A reissue does not undo the rest. A name, a home address and a wallet address together tie an identified person at a physical location to balances that anyone can read off a public ledger.
Gnosis Pay has made 3D Secure mandatory for all online card payments until the consumer system retires on December 20, a shutdown it says was scheduled before the breach. 3D Secure adds an authentication step at checkout on participating merchants, which raises the difficulty of using stolen card details online. The company said it has also increased monitoring of card activity and wallets and is arranging specialist monitoring for signs the data is being misused.
Cointelegraph cited OpenRate data showing about 2,400 daily active cardholders and $263,200 of transactions over the preceding 24 hours, a measure of recent activity rather than the number of people in the exposed records.
Decrypt reported that the company warned customers to expect phishing attempts and said it will never ask for seed phrases, PINs, full card numbers or transfers of funds.
This is not the company's first security problem this year. Gnosis Pay says on its own recovery page that it migrated users to a new card Safe after an incident in June, that most balances moved across automatically, and that any left in the old Safe have to be withdrawn manually, BlockchainReporter reported.
Gnosis Pay reported no loss of funds, unlike the thefts that have dominated crypto security this year, including the breach points Binance found in its own systems before setting aside $6.34 billion. Exposures of customer records have hit the sector repeatedly as well, among them the Metabase misconfiguration at Trezor's shipping partner that exposed 13,689 buyers in August.
The company says it is communicating with the applicable data protection authorities and with its card issuer, which it does not name, and that it has reported the breach to its partners. Its post says a full review is underway and that it understands "how serious it is to have your personal information exposed."
