Have I Been Pwned added data from a 2013 breach of the Russian-language cybercrime forum YouHack, revealing 7.2 million email addresses and weakly protected passwords. A separate Sberbank loyalty program breach added records tied to 48 million users.What happened
Have I Been Pwned added records Wednesday from a 2013 breach of YouHack, a Russian-language cybercrime forum. The dataset contains 7.2 million unique email addresses. About 107,000 of those addresses belonged to forum members, whose records included usernames, IP addresses and password hashes stored with unsalted MD5.
The breach reached beyond forum accounts. The leaked material also included millions of credentials that YouHack members posted about other victims. After the 2013 intrusion, YouHack moved to a different domain and continues to operate as a marketplace for stolen credentials and financial data. The records later appeared in the 2024 “Mother of all Breaches,” a 12-terabyte compilation of 26 billion records drawn from many security incidents.
Have I Been Pwned also cataloged a separate 2023 breach of SberSpasibo, a loyalty program run by Sberbank. That dataset holds records for 48 million users, including 3.3 million unique email addresses, phone numbers and dates of birth. The records stored bank card numbers as unsalted SHA-1 hashes. Reports from the time of the breach placed the records between April 2017 and February 2022. The pro-Ukraine hacktivist group NLB claimed responsibility for the SberSpasibo intrusion, an attack on Sberbank internal systems and partial credit for an attack on Alfa-Bank.
Legal basis
Data protection laws require organizations to secure personal information and limit the harm from unauthorized access. The European Union’s General Data Protection Regulation obligates controllers and processors to apply technical and organizational measures suited to the risk, including strong protections for account credentials and payment data. Articles 33 and 34 require notice to regulators and, in high-risk cases, to affected people after a personal data breach.
In the United States, the California Consumer Privacy Act grants California residents rights over personal information and supports enforcement when businesses fail to protect data. State breach notification laws across the country require companies to inform affected residents and, in many cases, state officials when exposed data creates a risk of misuse.
Impact on users and companies
Unsalted MD5 and unsalted SHA-1 give attackers a fast path to recover secrets. Attackers can test guesses at high speed and match identical values at once. For YouHack members, exposed usernames, IP addresses and crackable password hashes raise the risk of identification, account takeover and reuse attacks on other services. For the millions of victims whose credentials circulated on the forum, the resurfaced dataset extends the window for fraud, impersonation and targeted phishing.
SberSpasibo users face a different set of risks. Phone numbers, dates of birth and email addresses support identity theft and social engineering. Hashed card numbers can expose payment details if attackers match the hashes to valid numbers. Companies that hold similar data face costs tied to incident response, customer support, fraud monitoring and contractual claims from partners.
What changes
Under the GDPR, supervisory authorities can impose fines of up to 20 million euros or 4 percent of annual global turnover, whichever figure is higher, for failures that include inadequate security. In California, the attorney general and the California Privacy Protection Agency can seek civil penalties for violations of the CCPA, with higher amounts for violations involving the personal information of children.
For affected users, the practical steps start with account security. Anyone who reused a password tied to an address in the YouHack data should change it on every service and enable multifactor authentication. People linked to the SberSpasibo breach should watch bank statements, place alerts on financial accounts and treat unsolicited calls or messages that reference personal details as suspicious. For companies, the case reinforces a baseline: retire fast hashing algorithms for passwords, salt and strengthen stored secrets, and limit how long loyalty and payment records remain identifiable.
Click Here For The Original Source.
——————————————————–
