СберСпасибо (SberSpasibo) data breach: 3.3M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2023-03-09
In March 2023, data allegedly taken from СберСпасибо (SberSpasibo), the loyalty program of Russian bank Сбербанк (Sberbank), was published online. The data contained records relating to 48M users, including 3.3M unique email addresses alongside phone numbers and dates of birth. Data also included bank card numbers stored as unsalted SHA-1 hashes, plus loyalty program details such as membership dates and the redemption of bonus points for partner offers. Exposed data: bank card numbers, dates of birth, email addresses, loyalty program details, phone numbers. The breach dates from Mar 9, 2023; Have I Been Pwned loaded it on Nov 11, 2026.
What to do
- If you had a СберСпасибо (SberSpasibo) account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch