Gnosis Pay says attackers accessed customer data through legacy card system

Gnosis Pay said hackers compromised personal information in an older system supporting its consumer cards; the company detected unauthorized access on November 3 and disclosed the breach on Friday, November 6. Its response began two hours after detection and included replacing compromised credentials, repairing the flaw, and requiring 3D Secure, a card-payment verification step, until the system was turned off. Gnosis Pay said customer funds and its business card platform were unaffected. It emailed affected customers, contacted partners, regional issuers Monavate Ltd and UAB Monavate, and data protection authorities, but has not disclosed the number of customers or data involved; the system was due to be retired, with consumer cards set to stop working at 23:59 UTC on December 20.