Have I Been Pwned has added a data breach affecting Sberbank's SberSpasibo loyalty programme to its catalogue, recording records belonging to 48 million users. The breach itself dates from March 2023, but the data was only catalogued by the breach-notification service on Wednesday 11 November 2026, bringing the scale of the exposure into fresh focus. SberSpasibo is the loyalty programme of Sberbank, Russia's largest bank, and the leaked data covers its members. [The Register](https://www.theregister.com/cyber-crime/2026/11/11/2013-breach-at-russian-cybercrime-forum-resurfaces-with-millions-of-victims-credentials/5309065) ## What was exposed The dataset contained records relating to 48 million users, including 3.3 million unique email addresses alongside phone numbers and dates of birth. Have I Been Pwned records 3,288,711 breached accounts for SberSpasibo. Bank card numbers were also included, stored as unsalted SHA-1 hashes, along with loyalty programme details such as membership dates and the redemption of bonus points for partner offers. The combination matters: email addresses and phone numbers on their own are useful to scammers, but paired with dates of birth and card data they give fraudsters far more to work with. [2-Spyware](https://www.2-spyware.com/breaches/sberspasibo) ## A breach from March 2023 Data allegedly taken from SberSpasibo was published online in March 2023. Reporting on the breach at the time suggested the records were dated between April 2017 and February 2022, and the attack was claimed by the pro-Ukraine hacktivist outfit NLB. The same group also claimed responsibility for an attack on Sberbank's internal systems at the same time, and later took partial credit for an attack on Alfa-Bank, Russia's largest private bank. Have I Been Pwned's decision to load the data now means anyone can check whether their email address appears in it, more than three years after the data first circulated. [The Register](https://www.theregister.com/cyber-crime/2026/11/11/2013-breach-at-russian-cybercrime-forum-resurfaces-with-millions-of-victims-credentials/5309065) ## Why unsalted SHA-1 card numbers matter The card numbers were stored as unsalted SHA-1 hashes, which is a weak way to protect them. SHA-1 is fast to compute, and without a salt, identical card numbers produce identical hashes. That could let attackers test possible numbers against the leaked hashes for a match, rather than having to break strong encryption. The exposure does not by itself mean money was taken from accounts, and the leaked hashes are not the same as plain-text card numbers, but the data gives criminals a starting point for fraud and for highly targeted phishing messages that quote real personal details. [The Register](https://www.theregister.com/cyber-crime/2026/11/11/2013-breach-at-russian-cybercrime-forum-resurfaces-with-millions-of-victims-credentials/5309065) ## What affected users should do Anyone who held a SberSpasibo account should check their email addresses at Have I Been Pwned and treat a match as a prompt to act. Change the password on the affected account and on any other service where the same password was reused, and turn on two-step sign-in where it is offered, preferably with an authenticator app or a passkey. Expect targeted phishing: leaked contact details are used to write convincing fake messages that mention the breached company or the victim's real name, so do not click links in unexpected emails or texts about the account. Watch bank statements for unfamiliar transactions, be wary of calls or texts claiming to be from the bank, and consider a credit freeze or fraud alert where the country offers one, since dates of birth cannot be changed like a password. [2-Spyware](https://www.2-spyware.com/breaches/sberspasibo)