Data breach on the legacy system powering Gnosis Pay-branded cards - Gnosis Pay

Gnosis Pay disclosed that unauthorised access to the legacy system powering its Gnosis Pay-branded cards (its B2C business line) exposed certain customer information. Monitoring systems detected the access on 3 November 2026, and containment began within two hours; the affected credentials were replaced and the vulnerability addressed. The system was already scheduled for retirement on 20 December 2026, and the enterprise platform powering its white-label card programmes was not affected. Gnosis Pay says funds were not affected, has added mandatory 3D Secure for online card payments until retirement, and has emailed affected customers.