Member-only story

What the Gnosis Pay breach notice says

How do you keep legacy system security up before shutdown? Cut ingress and writes first. A date guards nothing.

Raza Hussain

11 min read1 hour ago

Press enter or click to view image in full size

Gnosis Pay’s monitoring caught unauthorised access on November 3, 2026, inside the card system it had already scheduled to retire on December 20. That left 47 days on the clock, and the legacy system breach was found inside them anyway.

If you run a Rails app with retiring in its wiki page, you know that system. Nobody owns it, nobody patches it, and it still holds live credentials and live customer data. The date on the calendar protects none of it.

Here’s what this piece adds to the news.

The Gnosis Pay post is specific about the response and silent on the cause, so the lesson is about the window, not the bug.

In a local Postgres lab, a database role I’d made read-only with a session default accepted an INSERT after one SET statement.…