SberSpasibo Breach: 3.3M Emails & Phones Exposed (2026)

Overview

A database allegedly belonging to СберСпасибо (SberSpasibo), the loyalty program operated by Russian banking giant Сбербанк (Sberbank), was published online in March 2023. The dump contained records relating to roughly 48 million loyalty program users, and within that trove, 3,288,711 unique email addresses were confirmed. The breach has since been verified and indexed by Have I Been Pwned (HIBP), giving affected individuals a concrete way to check their exposure.

The incident matters beyond the loyalty program itself. SberSpasibo accounts are tied to Sberbank customers, meaning the leaked identifiers can be cross-referenced against banking relationships, which raises the stakes considerably for anyone in the dataset.

What Was Exposed

The exposed fields break down into two categories with very different risk profiles.

Personal identifiers: email addresses, phone numbers, and dates of birth. These are high-value for identity theft because they are the exact data points banks, telecoms, and government portals use to verify identity during account recovery and customer support calls.

Sensitive derived data: bank card numbers stored only as unsalted SHA-1 hashes, plus loyalty program metadata such as membership dates and records of bonus points redeemed for partner offers. Unsalted SHA-1 hashes are a serious weakness: because no per-user salt was applied, identical card numbers produce identical hashes, so attackers can match leaked hashes against known card number lists and crack them with precomputed tables.

Identity Theft Risks

The combination of phone number, date of birth, and email is not a minor leak. With these three fields, an attacker can attempt SIM-swap attacks, impersonate a victim in call-center recovery flows, and craft convincing phishing that references real loyalty program activity. The redeemed-offer records even reveal which partner merchants a person uses, which is ideal material for targeted fraud.

The unsalted SHA-1 card hashes compound this. Even though card numbers are hashed, unsalted SHA-1 offers little protection against a determined attacker armed with rainbow tables.

What to Do Right Now

1. Assume your phone and date of birth are known. Treat unsolicited calls or messages referencing Sberbank or SberSpasibo with extreme suspicion. Never confirm a code or PIN to an inbound caller.
2. Enable strong 2FA where it is not SMS-based. Push notifications or authenticator apps resist SIM swap far better than text messages.
3. Watch your bank statements and loyalty point balances. Unexpected point redemptions are an early warning sign.
4. Change any password reused on the email address involved and never reuse it across banking or shopping accounts.
5. Consider whether your card is still active. If you had a card tied to SberSpasibo in early 2023, ask your bank about replacement or monitor for unrecognized charges.

How to Check If You’re Affected

Visit the HIBP breach page at haveibeenpwned.com/Breach/SberSpasibo for details, and search your own email on the main site to confirm exposure. Because only a subset of the 48M records contained unique email addresses, absence from email results does not guarantee your phone number was not leaked. If you have multiple emails, check each one.

Security Insight

Storing card numbers as unsalted SHA-1 hashes reflects a legacy approach that was already considered inadequate well before 2023; proper practice requires per-record salting and memory-hard hashing, or simply not storing card numbers at all. Compared with other loyalty program breaches, the real differentiator here is the proximity to a major bank, which turns ordinary PII into banking-grade targeting material. The lesson for consumers is that loyalty programs quietly accumulate the exact identity-verification data that fraudsters need. For ongoing reporting on similar incidents, see our cybersecurity news coverage.

Further Reading

• All High Breaches
• Recent Data Breaches