Gnosis Pay disclosed on November 6 that unauthorized access to a legacy system exposed customer information tied to its Gnosis Pay-branded consumer cards, Cryptonomist reported. The company says customer funds were unaffected and its enterprise white-label platform was not involved.
Unauthorized access was detected on November 3. Gnosis Pay says containment began within two hours, affected credentials were replaced and the vulnerability was fixed. It notified partners, data protection authorities and its card issuer, and emailed affected customers.
The company has made 3D Secure mandatory for online card payments, increased fraud monitoring and warned customers about phishing. The report does not say how many customers were affected or how the attacker got in. Branded card services were already scheduled to end on December 20.