The Evening Update: Gnosis Pay Discloses Consumer Card Data Breach as DigiCert Exposes Archived ID Scans
Gnosis Pay data breach exposed legacy consumer card customer data, while funds and its enterprise platform were unaffected. Also: DigiCert archive breach.
The Evening Update for November 7, 2026 leads with a Gnosis Pay data breach that exposed customer information held in the legacy system behind its branded consumer cards. A separate incident at DigiCert, which handles certificate orders, involved archived customer records and, in some cases, identity documents. Both disclosures trace back to old data kept in systems that were poorly secured.
QuickBeats Test
Gnosis Pay data breach reaches consumer card customers
Gnosis Pay has disclosed that attackers accessed customer information in the legacy system behind its consumer cards, as described in the original report at DefiPrime. The company detected the intrusion on November 3, 2026, made it public on November 6, and began containment within two hours. Its enterprise platform, which runs white-label card programs, and customer funds were not affected, Gnosis Pay says. The company has replaced the affected credentials, fixed the flaw that enabled access, notified partners, data protection authorities and its card issuer, and emailed each affected customer. The notice does not list the exposed fields or the number of victims, and the attacker has not been identified. Users have described exposure of names, home addresses, card details and linked crypto wallet addresses, but Gnosis Pay has not confirmed that as the full scope.
DigiCert breach exposes archived records and some ID scans
DigiCert says an unauthorized party read archived customer records from an internal business system between June 27 and July 2, 2026, and the company verified the activity on October 19, 2026, as set out in the original report at BleepingComputer. The root cause dates to a February 2025 server migration that left the system reachable from the internet, a detail DigiCert disclosed in an incident report on Mozilla's Bugzilla. Most affected people had names, business email addresses, phone numbers and business addresses. A small minority of accounts also held documents submitted during identity validation, such as driver's licenses and passports. The case shows how retention periods and network exposure together determine the damage from a single misconfiguration.
Related Articles
- IDScan.net Confirms Driver's License Data Breach as FBI Investigates 153 Million Scans
- Driver's License Data Breach: 153 Million Scans Sold on the Dark Web as FBI Investigates
- GS Retail Data Breach Draws $9.3M Fine After 1.66 Million Customer Records Leak
✔Human Verified
Researched and cross-referenced against primary sources by the Bytevyte editorial team. This article was generated with the assistance of artificial intelligence and reviewed by the Bytevyte editorial team.