Gnosis Pay breach exposed card numbers, home addresses and linked crypto wallets
Teaser from the source
Crypto debit-card provider Gnosis Pay said its monitoring detected unauthorised access on Nov 3 2026 to the legacy system powering Gnosis Pay-branded (B2C) cards, with containment starting within two hours. It published the disclosure on Nov 6 and said customer funds were not affected; its enterprise platform for white-label partner card programmes was outside the breach. Affected cards were blocked. Customer notices and reporting (CoinDesk, Cointelegraph) describe exposed full card numbers, expiry dates, CVV codes, names, home addresses and crypto wallet addresses linked to accounts, plus contact details and in some cases banking identifiers; Gnosis Pay says the exact fields varied by customer and emailed each person what was taken. It replaced compromised credentials, fixed the vulnerability, made 3D Secure mandatory for online card payments until the B2C system retires on Dec 20 2026, and is arranging monitoring for misuse.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on addresses
Other advisories
- MediumCVE-2026-119776frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses
- LowCVE-2026-99223keys: make keyring indexes independent of kernel addresses
- Not ratedosv:CVE-2026-121420SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses
- Not ratedosv:CVE-2026-99223keys: make keyring indexes independent of kernel addresses
- Not ratedosv:CLEANSTART-2024-YG47016usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init
- Not ratedosv:CLEANSTART-2026-UD44303Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL
- Not ratedosv:CLEANSTART-2026-WJ36170Improper validation of source IP addresses in OpenVPN version 2
- Not ratedosv:CLEANSTART-2024-BU24068usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init
Other news entries
- DigiCert Data Breach Impacts Business Customer InformationNewsSecurityWeek
- Researchers Find Residential Proxies on White House NetworkNewsSecurityWeek
- Harvard University data breach exposed info of 851,000 accountsNewsBleepingComputer
- FBI Flags Over 600 Addresses Tied to North Korea’s Binance HeistNewsSecurityWeek
- Chainalysis discloses data breach from "offensive agentic techniques"NewsBleepingComputer
- b14g: about 97M CORE drained from its Core staking contracts; contracts pausedBreachpwn.watch
- Chainalysis breach: all-customer password hashes and live tokens exposed; Reactor, KYT and Address Screening back onlineBreachpwn.watch
- Norway's aid agency Norad says attackers took names and emails of all 20,614 Grants Portal usersBreachpwn.watch
Source: https://pwn.watch/i/gnosis-pay-legacy-card-system-breach-nov-2026