SberSpasibo Loyalty Program Breach Exposes 3.3 M Email Addresses and Card Hashes

Qué ocurrió

A data dump attributed to SberSpasibo surfaced online in March 2023, containing records for 48 million members, including 3.3 million unique email addresses, phone numbers, DOBs and unsalted SHA‑1 hashes of bank‑card numbers. The breach was added to Have I Been Pwned on 11 Nov 2026; the exact compromise method has not been disclosed.

Por qué es importante para la confianza y el cumplimiento

• The incident tests the control objective of secure authentication and data‑at‑rest protection, a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001).
• Demonstrates the need for continuous monitoring of credential‑related controls and evidence collection for audit readiness.
• Highlights gaps in hashing practices that must be addressed to satisfy data‑protection requirements across frameworks.

Who is affected

Recommended actions

1. Implement salted, computationally‑hard hashing for any stored payment‑card data.
2. Require MFA and enforce strong, unique passwords for all user and admin accounts.
3. Run a control‑mapping exercise for credential‑protection and log the evidence in a Trust Center.