Live threats
HighMicrosoft FORGE Lab Discovers 33 New Linux Kernel CVEs, Including 8 Privilege‑Escalation Flaws BreachMaersk Confirms Legacy System Breach; Hackers Claim 100 GB Data Theft and $5 M Ransom Demand Rule changeTreasury publishes FY27 Social Impact Partnerships to Pay for Results Act Notice of Funding Opportunity DeadlineFarm Credit Administration amends employee payroll system of records under Privacy Act, effective Nov 24, 2026 CriticalMultiple Critical Vulnerabilities in Mozilla Firefox and ESR Enable Arbitrary Code Execution BreachRailway PaaS Reports Theft of Customer AI API Keys Resulting in $740K Unauthorized Usage Rule changeHHS publishes modifications to NIH system of records under the Privacy Act CriticalSGLang Remote Code Execution Exploit Compromises NEAR AI Inference Server, Exposes Data of ~100 Users and 18 Agents
Updated 07:51 UTC All intelligence →
Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
EN
JoinJoin
BREACH WATCH BRIEF High 🏦 Breach

SberSpasibo Loyalty Program Breach Exposes 3.3 M Email Addresses and Card Hashes

In March 2023, a data set from SberSpasibo, Sberbank’s loyalty program, was posted online, revealing 3.3 million email addresses, phone numbers, dates of birth and unsalted SHA‑1 card hashes. The breach underscores the need for strong credential‑protection and hashing controls to satisfy audit‑readiness across frameworks.

ADTP Breach Watch · November 11, 2026 · HIBP Latest Breaches RSS
SeverityHigh
Type🏦 Breach
ConfidenceHigh
ReportedNov 11, 2026
Financial Services & FinTech Financial services – retail banking customers Loyalty‑program providers handling PII and payment‑card data Unknown

What happened

A data dump attributed to SberSpasibo surfaced online in March 2023, containing records for 48 million members, including 3.3 million unique email addresses, phone numbers, DOBs and unsalted SHA‑1 hashes of bank‑card numbers. The breach was added to Have I Been Pwned on 11 Nov 2026; the exact compromise method has not been disclosed.

Why it matters for trust and compliance

  • The incident tests the control objective of secure authentication and data‑at‑rest protection, a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001).
  • Demonstrates the need for continuous monitoring of credential‑related controls and evidence collection for audit readiness.
  • Highlights gaps in hashing practices that must be addressed to satisfy data‑protection requirements across frameworks.

Who is affected

Financial services – retail banking customers Loyalty‑program providers handling PII and payment‑card data

Recommended actions

  1. Implement salted, computationally‑hard hashing for any stored payment‑card data.
  2. Require MFA and enforce strong, unique passwords for all user and admin accounts.
  3. Run a control‑mapping exercise for credential‑protection and log the evidence in a Trust Center.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the mapFollow Regulatory Watch
  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL

Get the Breach Digest

The incidents that matter for your vendors and your data, analyzed for practitioners, in one email.