# 2013 Russian Cybercrime Forum Breach Exposes Millions of Credentials Newly cataloged data reveals massive credential leaks from YouHack and Sberbank platforms. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-11-11 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/fa3f7512-992d-4271-81e2-7544f2785bcc ## Historical Breach Resurfaces A 2013 security breach at the Russian cybercrime forum YouHack has recently been cataloged by Have I Been Pwned. The incident exposed 7.2 million unique email addresses, including 107,000 forum members. The leaked data contained usernames, IP addresses, and unsalted MD5 password hashes, which are considered highly vulnerable to modern decryption techniques. ## Weak Password Security The use of unsalted MD5 hashes by a cybercrime forum highlights a significant lapse in digital hygiene. Because MD5 is computationally fast, attackers can rapidly test guesses against the hashes. Furthermore, identical passwords produce identical hashes, allowing for efficient pattern matching that compromises user accounts across multiple platforms and services. ## Forum Persistence Despite the 2013 security failure, the YouHack forum remains operational today. The platform migrated to a different domain following the incident and continues to serve as a marketplace for stolen credentials and financial data. This persistence demonstrates the resilience of illicit cybercrime networks even after suffering significant internal data security lapses. ## Mother of Breaches Data collated from the YouHack incident was eventually integrated into the 2024 collection known as the Mother of all Breaches. This massive compilation contains 26 billion records and spans 12 terabytes of data. It represents a culmination of various security failures, aggregating stolen information from numerous sources into one singular, dangerous repository. ## Sberbank Loyalty Breach In a separate incident, Have I Been Pwned reported on a 2023 breach involving the Sberbank loyalty program, SberSpasibo. This leak exposed records belonging to 48 million users, including 3.3 million unique email addresses. The compromised dataset also contained sensitive personal information such as phone numbers and dates of birth for the affected users. ## Financial Data Vulnerability The SberSpasibo breach involved bank card numbers stored as unsalted SHA-1 hashes. This storage method allows attackers to test potential card numbers against the leaked hashes to find matches. The records involved in this specific attack were dated between April 2017 and February 2022, indicating a long-term exposure of sensitive financial information. ## Hacktivist Involvement The Sberbank attack was claimed by the pro-Ukraine hacktivist group known as NLB. This organization also took responsibility for infiltrating Sberbank's internal systems during the same timeframe. Furthermore, the group claimed partial credit for a subsequent cyberattack against Alfa-Bank, which currently stands as the largest private banking institution operating within Russia. ## Broader Security Implications These incidents underscore the critical risks associated with improper password hashing and the long-term impact of data leaks. Whether involving criminal forums or major banking institutions, the aggregation of stolen credentials into massive datasets poses a persistent threat. Organizations must prioritize robust encryption standards to mitigate the potential for widespread identity theft. ## Sources covering this story - https://www.theregister.com/cyber-crime/2026/11/11/2013-breach-at-russian-cybercrime-forum-resurfaces-with-millions-of-victims-credentials/5309065 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._