Gnosis Pay data breach links card holders' homes to crypto wallets

Gnosis Pay, which issues Visa debit cards that spend from self-custodied crypto wallets, says attackers got into the legacy system behind its own-brand cards and exposed customer information. The company disclosed the breach on Friday, three days after its monitoring detected the unauthorised access on November 3, and says customer funds were not affected.

The breach notice one customer received lists far more than card data. The email sent to Rotki founder Lefteris Karapetsas, which he posted on Friday, says the attackers accessed his name, email address, phone number, home address and nationality; the wallet addresses linked to his account, his identity verification and account status; his IBAN and BIC where an IBAN had been set up through Gnosis Pay's Monerium integration; and the full card number, expiry date and security code (CVV) of his card. It says identity documents and dates of birth were not included. Gnosis Pay says the data involved varied by customer and that each notice was tailored to the person receiving it.

Why the combination matters

Together those fields tie a named person and their home address to every crypto wallet linked to the account, and so to the balances anyone can see on chain. Gnosis Pay tells customers to be careful who they share their address or details of their crypto holdings with, "online and offline", and to distrust any message about their card or account even if it contains their real details or a real purchase.

How the disclosure unfolded

On November 3 Gnosis Pay emailed some customers that "a small number of cards" on its legacy system "may have been exposed to unauthorized access", cancelled those cards and said it had seen no unusual activity, according to the message Karapetsas shared that day. Friday's notice says containment began within two hours of detection, that the company replaced the affected credentials and "addressed the vulnerability", and that each affected customer has now been told exactly what was taken.

The breach was limited to the system for Gnosis Pay-branded cards, the company says, which was already due to be retired on December 20. Its enterprise platform behind white-label card programmes was not affected. Until the retirement it has made 3D Secure verification mandatory for all online card payments and increased monitoring of card activity and wallets.

What is not known

Gnosis Pay has not said how many customers were affected, what the vulnerability was, or how the attackers got in. It says it has told its partners, its card issuer and the relevant data protection authorities, and that it will never ask customers for seed phrases, private keys, PINs or card numbers, or ask them to move funds.