haveibeenpwned.com SberSpasibo Data Breach Exposes 3.3M Accounts
Article Content
- •3.3 million unique email addresses exposed in the SberSpasibo breach.
- •Data includes sensitive information such as phone numbers and bank card hashes.
- •Users are urged to change passwords and enable two-factor authentication.
In March 2023, data from СберСпасибо (SberSpasibo), the loyalty program of Russian bank Сбербанк (Sberbank), was allegedly published online, affecting 48 million users. The breach includes 3.3 million unique email addresses, phone numbers, and dates of birth. Additionally, bank card numbers were stored as unsalted SHA-1 hashes, alongside loyalty program details such as membership dates and bonus point redemptions. The breach was added to Have I Been Pwned on November 11, 2026, indicating ongoing awareness and concern about the incident. Users are advised to change their passwords and enable two-factor authentication where possible. The breach highlights significant vulnerabilities in data protection practices at financial institutions.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Sberbank in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What types of data were exposed?
When did the breach occur?
What should affected users do?
Continue Reading
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…