Gnosis Pay reveals data leak on its crypto card system

Coin Encyclopedia Improve your knowledge of cryptos

On November 3, Gnosis Pay's monitoring tools detected unauthorized access to the system that powers its cards, and the security team took over without delay.

Containment begins in less than two hours, the security identifiers concerned are then replaced, and the vulnerability closed.

In its announcement, Gnosis Pay mentions names, postal addresses and data linked to wallets.

We had a data breach affecting the system powering Gnosis Pay-branded cards (our B2C business line) that resulted in the exposure of certain customer information. Everyone affected was sent an email today with full information. We deeply regret that this happened. While funds…

The press release does not say how many customers the leak affects, and three days pass between detection and public announcement. Each affected customer received by email the exact list of information taken from their account.

The data exposed is more sensitive than a simple list of email addresses. A crypto card connects a verified identity to an on-chain wallet, the balance of which remains readable by everyone on an explorer, and the pseudonymity of the customers concerned suddenly disappears.

For example, an attacker who knows a customer's address and assets can prepare a tailor-made scam. He slips in just the right amount of true details to trap his target.

The leak remains confined to the general public system, which was promised to be shut down on December 20 anyway. The corporate platform, which powers white label card programs, remains spared.

No, replies the company in its press release. The incident did not cost customers any funds, and the protection of personal data is as important as that of money, recognizes Gnosis Pay.

Gnosis Pay has strengthened monitoring of cards and wallets to spot any fraud attempts, and specialized monitoring will look for any reuse of exposed data.

3D Secure is now mandatory for all online card payments, an additional validation, often by code, when paying.

The company also alerted its partners, its card issuer and data protection authorities. These measures will remain in place until the service is stopped, scheduled for December 20.

The main risk is downstream, where fresh personal data fuels phishing, such as the fake emails that targeted the Bitcoin Passport wallet at the end of October.

A message that cites a real name and a real purchase is no more legitimate. Gnosis Pay advises not to open their links and to go through its official application.

Machine-translated from French