What happened

On 3 November 2026, our monitoring systems detected unauthorised access to the system powering Gnosis Pay-branded cards (our B2C business line), resulting in the exposure of certain customer information.

Our security team responded immediately and containment began within two hours of detection. We subsequently replaced the affected security credentials and addressed the vulnerability.

The data breach was limited to the system powering Gnosis Pay-branded cards, which was already scheduled for retirement on 20 December 2026. Our enterprise platform, which powers all of our white-label card programmes, was not affected.

What we're doing

We have increased our monitoring of card activity and wallets to detect fraud or attempts to access user funds. We have also implemented an extra verification step (3D Secure) and made it mandatory for all online card payments. These measures will stay in place until the B2C system is fully retired as planned on 20 December 2026.

Today we emailed every affected customer with exactly what information was taken from their account, reported the breach to our partners, and are communicating with the applicable data protection authorities and with our card issuer.

Our apology

We sincerely apologise.

We understand how serious it is to have your personal information exposed, and we deeply regret that this happened. While funds were not affected, we recognise that the security of personal information is just as important.

We are carrying out a full review and applying what we learn across our systems, and we are arranging specialist monitoring for any sign that information from this data breach is misused.

What we’re advising customers

Be suspicious of any unexpected email, text, call or letter about Gnosis Pay, a Partner App or your card, even if it includes your real details or a real purchase. Don't click its links. Go to the official Gnosis Pay web app or your Partner App directly.

Never share your seed phrase, private keys, PIN or full card number. We and our Partner Apps will never ask for these, or ask you to "re-verify" your identity by email or text. We will also never ask you to move funds by email, text or phone. Any change to your account is only ever made inside the official Gnosis Pay web app or your Partner App.

Be careful who you share your address or details of your crypto holdings with, online and offline.

Additional actions have been recommended to customers based on the specific information that was accessed.

Contact us

All affected customers have been emailed but, if you have concerns, please contact help@gnosispay.com. Please bear with us as we prioritise customers directly affected by the breach.