Gemalto

Gemalto
Company type	Public (until acquisition)
Industry	Digital security, software applications, smart cards, electronic wallets, managed services
Predecessor	Axalto, Gemplus International
Founded	June 2006; 20 years ago
Founder	Marc Lassus, Daniel Le Gal, Philippe Maes, Jean-Pierre Gloton, Gilles Lisimaque (founders of Gemplus)
Defunct	April 2019
Fate	Acquired by Thales Group and rebranded as Thales DIS (Digital Identity and Security)
Headquarters	Amsterdam, The Netherlands
Area served	Worldwide
Products	Software applications, secure personal devices (smart cards, tokens), electronic wallets, managed services
Number of employees	15,000 (2019)
Parent	Thales Group (since April 2019)
Website	www.thalesgroup.com/en/markets/digital-identity-and-security

Gemalto was a global leader in digital security, focusing on software applications, secure personal devices such as smart cards and tokens, electronic wallets, and managed services. Established in June 2006 through the merger of Axalto and Gemplus International, Gemalto generated €2.969 billion in revenue during 2018.

Following its acquisition by Thales Group in April 2019, it now operates under the name Thales DIS (Digital Identity and Security). Prior to this acquisition, Gemalto was recognized as the largest SIM card producer worldwide.

Thales DIS is headquartered in Amsterdam, The Netherlands, with a global presence through subsidiaries. The company employs around 15,000 people across 110 offices, supported by 24 manufacturing facilities, 47 personalization centers, and 35 research and development centers located in 47 countries.

History

Gemalto was created in June 2006 when smart card manufacturers Gemplus and Axalto combined forces, merging their brand identities. Axalto itself originated as a spin-off from Schlumberger following an IPO in 2004.

Between the merger and 2015, Gemalto expanded aggressively by acquiring several companies: Leigh Mardon's personalization center in Taiwan, Multos International, NamITech from South Africa, NXP’s mobile services division, O3SIS (a mobile software firm), Trusted Logic (provider of secure software platforms), Serverside (specializing in bank card personalization), XIRING’s banking unit, Netsize (mobile commerce solutions), Valimo Wireless (mobile authentication), Swedish internet banking security firm Todos AB, German M2M specialist Cinterion, SensorLogic (M2M services), Plastkart in Turkey, Ericsson’s mobile payment platform IPX, information security firm SafeNet, and Buzzinbees, experts in SIM activation.

Axalto and Schlumberger

Schlumberger initiated chip card operations in 1979 by licensing innovations from Roland Moreno. It developed the first telephone chip cards for France Telecom and Telia during the early 1980s and played a role in defining the GSM standard. In the early 1990s, Schlumberger created its inaugural SIM card to support GSM rollout across Europe—a design that became a global benchmark powering over three billion mobile devices.

During the early 1980s, France's banking industry transitioned from magnetic stripe to microprocessor cards. Schlumberger secured a contract in 1981 to provide GIE Cartes Bancaires with microprocessor cards and POS terminals. This initiative eventually evolved into the EMV global standard established by Europay, MasterCard, and Visa.

From the 1980s through the early 2000s, Schlumberger expanded both its revenue streams and product portfolio within chip cards and GSM telecommunications. It acquired regional card manufacturers such as Cowells (UK), Malco (US), Printer (Mexico), Cardtech (Brazil), Solaic (France), and Bull-CP8 (France/China).

In 2003, Schlumberger consolidated its card manufacturing and POS terminal businesses into Axalto, which went public on Euronext Paris on May 18, 2004.

Gemplus

Founded in 1988 by Marc Lassus, Daniel Le Gal, Philippe Maes, Jean-Pierre Gloton, and Gilles Lisimaque, Gemplus initially supplied prepaid phonecards. Its strong foothold in prepaid phonecards throughout the 1990s helped it build solid relationships within the telecommunications industry, including with Schlumberger.

Until 1999, Gemplus operated as Gemplus S.C.A., a French limited partnership. In December of that year, Gemplus Associates merged into Gemplus S.C.A., which then transformed into the joint stock company Gemplus SA. By February 2000, restructuring led to the creation of Gemplus International SA as a Luxembourg-based holding company. At this stage, Texas Pacific Group became an equity investor.

Gemplus completed its initial public offering in December 2000 with shares listed on Euronext Paris and ADSs on NASDAQ. By 2004, it further reorganized by transferring most subsidiaries from Gemplus SA to Gemplus International SA.

In April 2005, Gemplus broadened its portfolio by acquiring Finland’s Setec Oy, a provider of traditional and electronic travel passports along with secure printing solutions for government agencies.

The merger between Gemplus and Axalto in June 2006 led to the formation of Gemalto, reinforcing their combined leadership within the smart card sector.

Android patent litigation

In October 2010, Gemalto initiated a patent infringement case against Google, Samsung, HTC, and Motorola in the Eastern District of Texas. The complaint alleged that Android devices incorporated memory management technologies protected by Gemalto's patents. Industry analysts projected that a successful outcome could yield annual royalty earnings between €30 million and €50 million. Nevertheless, in June 2014, the US Court of Appeals ruled in favor of the defendants, determining that there was no violation of Gemalto’s patent rights.

Takeover by Thales

Gemalto received a €4.8 billion acquisition offer from the Thales Group in December 2017, which was subsequently endorsed by its board subject to regulatory approvals worldwide. The transaction was completed in April 2019, following Thales’ divestiture of its General Purpose HSM division to Entrust Datacard in order to comply with European Union antitrust requirements.

Corruption investigation

In February 2023, Gemalto became the focus of a judicial probe concerning allegations of "corruption" and "criminal association" linked to contracts with governments across six African nations.

Corporate structure

Gemalto N.V. functions as the Group’s holding company, possessing an authorized share capital of €150 million, represented by 150 million ordinary shares. By October 2012, 88 million shares had been issued and were outstanding. Since 2006, Gemalto has operated through three primary business segments: Telecommunications, secure transactions, and Security, each supported by departments including marketing, operations (encompassing production and research & development), finance, human resources, and legal affairs.

Integration into Thales

In April 2019, Thales finalized its €4.8 billion acquisition of Gemalto, incorporating it as its seventh global division under the name Digital Identity and Security (DIS).

Telecommunications

Gemalto provides software solutions, subscriber identity modules (SIM), and managed services to a subscriber base exceeding 700 million worldwide, partnering with more than 400 mobile network operators.

Since 2007, Gemalto’s telecommunications operations have been structured into four categories: secure operated services; advanced products and data services; value-added products; and SIM cards.

Starting in 2000, Gemalto has annually organized the "SIMagine" competition aimed at fostering innovation in SIM technology, with sponsorship from industry leaders such as Samsung Semiconductor Europe and Sun Microsystems.

Following its acquisition of Buzzinbees in 2016, Gemalto launched SIM reactivation capabilities, allowing operators to enable customers to reactivate expired SIM cards for renewed subscriptions rather than purchasing new ones.

Near field communication (NFC) and mobile payments

On October 30, 2008, Royal Bank of Canada, Visa, and Rogers Wireless announced a partnership to advance mobile payment pilot programs that explored wireless delivery of payment applications and credit card credentials directly to consumers’ phones. Gemalto was designated as the trusted service manager responsible for securely transferring credit card data from RBC to the SIM cards embedded in Rogers’ NFC-enabled devices.

Gemalto has acted as TSM for NFC pilot projects across multiple countries including France and Taiwan. In November 2007, it collaborated with Taiwan’s Far EasTone Telecommunications Ltd. to launch Asia’s inaugural SIM-based NFC trial under the auspices of the GSM Association’s "Pay-Buy Mobile" initiative.

Mobile Signatures

In November 2008, Turkish telecom provider Turkcell implemented Gemalto's SIM-based mobile signature technology, allowing its 30 million users to securely authenticate for services demanding strong verification—such as online banking and e-government portals—through legally recognized electronic signatures created directly on their mobile devices.

Banking & Payment

Gemalto offers a range of EMV chip cards—including contact, hybrid, dual interface, and contactless varieties—alongside payment terminals and authentication solutions designed to secure online banking transactions. Through its subsidiary Gemplus Associates, the company has invested in tokenization technologies and Mondex electronic cash systems, with operations extending to South Korea.

According to the Nilson Report, Gemalto holds the position as the world's leading chip card manufacturer, distributing 1.5 billion cards and capturing 49% of the market share. In early 2010, a software malfunction impacted approximately 20 million ATM cards and 3.5 million credit cards across Germany.

Serving more than 300 banking institutions globally, Gemalto's prominent clients in banking and retail include Santander UK, ABN AMRO (Netherlands), Aktia (Finland), American Express, Banque Accord (France), Accord Italia (Italy), Caisse d'Épargne (France), La Caixa (Spain), Crédit Agricole (France), Diners Club Croatia, Findomestic Italy, Fortis Belgium, Hansabank Estonia, HBOS UK, HSBC UK, ING Belgium, JCB, LHV Pank Estonia, National Bank of Greece, OpBank, Parex Bank (Latvia), Sampo (Finland), and Société Générale. Among corporate clients are Agip France, Arena Netherlands, BMW, B.P., Esso, Sodexo, and Total France.

EMV Cards

Gemalto has supplied EMV cards to numerous financial organizations worldwide. In September 2008, Turkey’s Garanti Bank introduced 300,000 Gemalto EMV contactless bank cards. Later in April 2016, Saudi Arabia’s National Commercial Bank (NCB) selected Gemalto as its provider for dual-interface EMV cards.

Instant Issuance

By November 2008, Gemalto’s Instant Issuance solution had been deployed in over 300 shopping centers globally, facilitating the immediate issuance of approximately one million credit cards each year.

CardLikeMe

In July 2008, Gemalto unveiled its CardLikeMe service in partnership with PlasticNow in Canada, enabling customers to personalize their cards by adding personal photographs.

eBanking and eCommerce Security

Following the acquisition of Swedish security company Todos AB in April 2010, Gemalto broadened its eBanking and eCommerce security portfolio under the Ezio brand. The Ezio Suite encompasses:

The Ezio Server that supports various authentication methods including two-factor authentication, one-time passwords, challenge–response protocols, dynamic signatures, and sign-what-you-see functionality.
Authentication hardware such as smart card readers and security tokens.
Mobile authentication options via SIM-based solutions, dedicated applications, or SMS.

Gemalto complements the Ezio Suite with a range of services including deployment assistance, security assessments, design consulting, training programs, fulfillment operations, and ongoing support. Leading banks utilizing Ezio technology include ABN AMRO, Barclays, and Nordea.

Barclays

By mid-2008, more than one million customers of Barclays were utilizing Gemalto's cryptographic smart card reader, marketed as PINsentry by Barclays, to enable robust authentication for online banking.

FINO PayTech Limited

Starting in June 2007, India's Financial Information Network and Operations Ltd. (FINO PayTech Limited) began implementing Gemalto smart cards integrated with biometric authentication technology to facilitate microbanking services and reach the underbanked communities in rural regions.

Biometric cards

Beginning in 2018, Gemalto introduced biometric cards equipped with fingerprint sensor technology.

In October 2019, through a collaboration with Mastercard, these biometric cards were supplied to NatWest in the United Kingdom.

The following month, November 2019, Gemalto provided biometric fingerprint cards to Cornèrcard in Switzerland in partnership with Visa.

e-Passports

Gemalto delivers electronic passport (e-passport) solutions to government agencies globally, including countries such as Australia, Colombia, Czech Republic, Denmark, Estonia, France, India, Italy, Latvia, Morocco, Norway, Poland, Portugal, Qatar, Singapore, Slovenia, Sweden, Turkey, Peru, Malaysia, the United States, and the United Kingdom.

By March 2007, Gemalto had equipped over 10 million e-passports worldwide and held approximately 30% of the market as the leading supplier.

In the United States, Gemalto was one of two providers chosen by the Government Printing Office for the e-passport initiative in 2007.

As of September 2017, Gemalto's biometric ePassport solutions were implemented in more than 30 nations including Algeria, Denmark, Finland, Hong Kong, France, Italy, Korea, Morocco, Norway, Peru, Portugal, Singapore, Sweden, and the US.

e-Driver’s licenses

In 2007, Mexico’s licensing agency (ICV) utilized Gemalto's smart card technology to issue the country's first electronic driver's licenses in Monterrey, Nuevo León. The company projected delivering upwards of 900,000 licenses to ICV over a three-year span. By April 2008, Gemalto had secured agreements to provide electronic driver's licenses to three additional Mexican states.

December 2007 saw Gemalto begin supplying Sweden with e-driver's licenses that incorporated a transparent window within the polycarbonate card for improved security features. The contract involved annual delivery of 600,000 licenses over a three-year period.

e-ID Citizen cards

Portugal’s Mint and National Printing Office (INCM) selected Gemalto in February 2007 to supply their national e-ID Citizen Card system. Gemalto provides the operating system along with personalization tools, applications, middleware components, and customer support services. These cards function as Portugal’s official national identity document.

e-Healthcare cards

By September 2007, Gemalto had produced its 100 millionth electronic healthcare card across various markets including Algeria, Belgium, China, Finland, France, Germany, Mexico, Puerto Rico, Slovenia, the UK, and the US.

In July 2007, German health insurer Allgemeine Ortskrankenkasse (AOK) contracted Gemalto for the supply and personalization of 35 million e-health insurance cards containing critical emergency information such as blood type, allergy warnings, ongoing medical treatments, and electronic prescriptions.

e-Government ID

By December 2009, Gemalto had supplied 25 million Common Access Cards to the United States Department of Defense, facilitating identification for both employees and contractors.

Starting from September 2017, electronic identification incorporated into ID cards issued by the Swedish Tax Agency has been provided through AB Svenska Pass, a subsidiary company of Gemalto.

Transportation

Gemalto has equipped numerous national and municipal transportation initiatives with contactless payment solutions in cities such as Amsterdam, Boston, Paris, London, São Paulo, and Santiago. Worldwide, the company has produced more than 100 million transit cards.

Security and enterprise

Gemalto delivers its enterprise solutions via value-added resellers (VARs) and systems integrator partners. Prominent clients include Barclays, Shell, Chevron, Pfizer, Boeing, Telia Sonera, Schlumberger, and Microsoft.

In April 2008, Alternative Technology and Envoy Data Corporation broadened Gemalto’s market presence by distributing its Device Administration Service (DAS) on demand through their extensive reseller channels across North America.

Pfizer

At Pfizer, 100,000 staff members rely on Gemalto smart cards as secure employee identification badges.

Virchow Krause

In July 2008, Gemalto implemented Protiva .NET Dual tokens at Virchow Krause & Company LLP (VK), ranked as the 15th largest accounting firm in the U.S., to strengthen protection of client information.

Microsoft partnership

Microsoft’s global workforce utilizes Gemalto’s .NET smart card technology embedded within their corporate ID badges to gain access to company information systems.

In June 2008, Gemalto introduced Instant Badge Issuance (IBI), a solution that integrates directly with Microsoft Active Directory and Identity Lifecycle Manager (ILM) for seamless digital certificate loading onto smart cards.

During Microsoft’s "Heroes Happen Here" event in February 2008, Gemalto and Microsoft demonstrated the only .NET smart card technology with native support in Microsoft Windows Server 2008.

In November 2007, Gemalto showcased its .NET smart card products—including the Protiva Strong Authentication Server—compatible with the Windows Smart Card Framework at Microsoft’s Redmond campus. That same month marked Gemalto’s achievement of Gold Certified Partner status within the Microsoft Partner Program.

In 2006, Gemalto hosted the SecureTheWeb competition sponsored by Microsoft to encourage advancements in secure personal devices for web services such as smart cards and one-time passwords (OTPs).

Citrix Systems partnership

In December 2007, Citrix Systems recognized Gemalto’s Protiva platform as compatible with the Citrix Access Gateway. Earlier that year, in January 2007, Gemalto’s .NET and Protiva offerings had received Citrix Ready certification.

Gemalto was also a finalist for Citrix Systems’ Solution Partner of the Year award in 2006.

Verisign

In February 2007, Gemalto announced that its Network Identity Manager (NIM) would support the VeriSign Identity Protection (VIP) Network for enhanced online security.

Allegations of 3G/4G SIM Card Encryption Key Compromise

Classified files disclosed by Edward Snowden revealed that the NSA and GCHQ's Mobile Handset Exploitation Team penetrated Gemalto's systems to extract SIM authentication keys, facilitating covert surveillance of mobile communications. The operation was designated "DAPINO GAMMA" by GCHQ. These documents further indicated the agencies’ capability to alter billing data to conceal their actions and to access authentication servers for decrypting voice calls and text messages. Snowden highlighted that this breach put at risk billions of devices relying on SIM-based encryption, prompting the need for a recall and replacement of all affected Gemalto-issued SIM cards.

This event sparked scrutiny over Gemalto chairman Alex J. Mandl due to his connections with the CIA-affiliated venture capital firm In-Q-Tel. Both GCHQ and NSA refused to provide comments. On February 25, 2015, Gemalto confirmed having "reasonable grounds" to suspect the NSA and GCHQ’s involvement but denied any unauthorized access or theft of authentication keys.

Vulnerability in Smart Card Weak Keys

In October 2017, it was discovered that Gemalto's IDPrime.NET smart cards, utilized internally by Microsoft and other enterprises, were susceptible to the Infineon weak key vulnerability, which could allow attackers to derive private cryptographic keys.

Collaborations

Gemalto maintains strategic alliances with companies such as Wipro, Prodapt, Maya, Sendum, Unique Computing Solutions, Symphony Teleca, Bing, Kore, and West. Notably, in 2017, Gemalto’s M2M Module was incorporated into OnKöl’s home care hub device.