What happened
Gnosis Pay said on November 6, 2026 that on November 3 its monitoring systems detected unauthorized access to the legacy system that powers Gnosis Pay-branded consumer cards (its B2C line).
The company says containment began within about two hours, affected security credentials were replaced, and the vulnerability was fixed. The enterprise platform that powers white-label partner card programmes was not affected. User funds were not affected.
That B2C system was already scheduled to retire on December 20, 2026. Until then Gnosis Pay has made 3D Secure mandatory for all online card payments and increased monitoring of card activity and wallets. It says it reported the incident to partners, its card issuer, and applicable data protection authorities. No public count of affected accounts has been given.
What data was exposed
Fields vary by customer. Gnosis Pay emailed every affected customer with exactly what was taken from their account. Do not assume your notice matches someone else's.
Public shares of those notices include name, shipping or home address, Gnosis Pay account reference, and card-order information that can identify a linked wallet. At least one cardholder said their notice also listed card details and linked wallet addresses. Treat that as one person's notice, not a company-wide inventory.
Gnosis Pay says funds were not taken. Do not assume your full card number, PIN, or CVV were in scope unless your own notice says so.
What to do now
The main risk is phishing that already knows your name, address, or wallet details. Gnosis Pay and Partner Apps will not ask for seed phrases, private keys, PINs, or full card numbers by email or text, and will not ask you to move funds that way.
- 01Read the email from Gnosis Pay carefully. It lists what was taken from your account.
- 02Be suspicious of any unexpected email, text, call, or letter about Gnosis Pay, a Partner App, or your card, even if it includes real details. Do not click its links. Open the official Gnosis Pay web app or your Partner App yourself.
- 03Never share your seed phrase, private keys, PIN, or full card number. Hang up on anyone asking you to re-KYC, re-verify, or move crypto outside the official app.
- 04Watch for address or wallet-linked phishing. A home address tied to onchain activity is enough for a convincing scam.
- 05Keep an eye on card activity. Extra 3D Secure is on until the B2C system retires December 20, 2026.
- 06If you have concerns and already got a notice, contact help@gnosispay.com from an address you control, not by replying to a cold message.
How to check if you were in it
The surest sign is the notice email from Gnosis Pay. Have I Been Pwned is free and the best known place to check an email against public breaches. This one may not appear there unless the data leaks publicly.
OSINT Pro's email lookup checks breach records and stealer logs, which catch passwords stolen by malware on your own device. That is useful for older email leaks, even when a new incident is not in the index yet.
OSINT Pro does not have the Gnosis Pay customer dataset. If it ever leaks publicly and gets indexed, we will update this page.