What to Do After the SberSpasibo Data Breach (Sberbank Loyalty Leak)

What Happened in the SberSpasibo Data Breach

SberSpasibo (СберСпасибо) is the loyalty and bonus-points program of Sberbank, Russia's largest bank. In March 2023, files said to come from the program were published online. Researchers at the Russian threat-intelligence service DLBI reported records covering roughly 48 million users, released in two parts and spanning accounts from about 2017 to 2022.

Sber did not confirm a breach. It said that reports like this often involve old compilations repackaged by scammers, and Russia's data regulator Roskomnadzor said it would look into the claims. On November 11, 2026, Have I Been Pwned (HIBP) verified and loaded the data, which contains 3.3 million unique email addresses. Most records have a phone number but no email address, so the number of people affected is far larger than the email count suggests.

What Data Was Exposed

• Phone numbers — the main identifier for most of the 48 million records
• Email addresses — 3.3 million unique addresses
• Dates of birth
• Bank card numbers stored as unsalted SHA-1 hashes
• Loyalty program details such as membership dates and which partner offers bonus points were redeemed for

1. 1

   Step 1 of 5: Check Whether You Are in the Breach

   Enter your email addresses at haveibeenpwned.com. If "SberSpasibo" appears, your email, phone number and date of birth are probably in the files. If you used SberSpasibo between 2017 and 2022 but your email is not listed, assume your phone number is still in the leak, since most records contain a phone number without an email.

2. 2

   Step 2 of 5: Replace or Watch the Card Used With the Program

   1. Check whether the card you linked to SberSpasibo between 2017 and 2022 is still active.
   2. If it is, consider asking your bank to reissue it with a new number. Use only the official app or the number printed on the back of your card.
   3. Turn on transaction notifications and review statements for small "test" charges, which often come before larger fraud.
   4. If you see charges you do not recognize, block the card immediately. Our guide on what to do if your card information is stolen covers the dispute process.

   A hashed card number alone usually does not include the expiry date or CVV, so it is more useful for building convincing scams than for direct online purchases. That is why Step 3 matters most.

3. 3

   Step 3 of 5: Expect "Bank Security Service" Calls

   The most common use of leaks like this is phone fraud. A caller claims to be from the bank's security department, reads out your name, birthday, card ending and recent bonus activity to sound legitimate, then says your account is under attack. The goal is to get a one-time code, card details, or a "transfer to a safe account."

   • Hang up and call your bank back on the number on your card or in the official app.
   • Never read out an SMS code. No real bank employee will ask for one.
   • Never move money to a "safe account." There is no such thing.
   • Do not install remote-access apps a caller asks you to install.

   The playbook is the same worldwide; our guide to bank impersonation scams breaks down the common scripts.

4. 4

   Step 4 of 5: Be Careful With Texts and Emails About Bonuses

   Because the leak includes loyalty data, expect messages about "expiring bonus points," prize draws or partner offers that link to fake login pages. Open your loyalty and banking accounts only through the official app or a bookmarked address. Our guide to spotting smishing texts explains the warning signs, and the steps in securing a hacked loyalty account apply if your points disappear.

5. 5

   Step 5 of 5: Secure the Email Address in the Leak

   If your email is listed, change its password if you have reused it anywhere, and turn on two-factor authentication. A breached email combined with a phone number and date of birth is enough for many account-recovery scams, so protect the inbox first.

   Living Outside Russia?

   Many SberSpasibo members now live abroad. If you are in the U.S., your leaked phone number and birthday can be matched with people-search sites that publish your current address, relatives and other numbers. That combination makes impersonation calls much more convincing, so it is worth removing those profiles too.

Reduce What Scammers Can Find About You

You cannot remove your records from a leaked file, but you can limit what else is available to combine with it. For U.S. residents, the largest source of that extra detail is data brokers. If you are choosing a service to handle removals, our ranking of the best data removal services compares the options.

PrivacyOn removes your information from 100+ data broker and people-search sites, monitors 24/7 for re-listings, and includes dark web monitoring that alerts you when your email or phone appears in a new breach. Plans start at $8.33/month, with family plans covering up to 5 people. Run a free scan to see where your data is exposed.

Frequently Asked Questions