Sberlogistics

"Sberbank" is a logistics operator of a federal scale, developing its own warehouse infrastructure, courier delivery and a network of points of issue of orders in all regions of Russia. The company implements technological logistics solutions with uniform standards of service quality throughout the country and abroad for private and corporate clients.

History

2024: The leak from "Sberbank" allegedly occurred due to the lack of two-factor authentication

In February, the court published documents on the case of leakage of information from the information system "Sberbank," which occurred a year ago - in February 2023. The court recognized the leakage of 670017 lines of personal data of customers and 10756 records of employees of the company itself, which contain names, email addresses and phones. The amount of the fine was not disclosed to the operator in the court order, but a fine of up to 60 thousand rubles was imposed for similar offenses.

The court considered the intercepted administrator password to be the reason for the leakage of personal data of "Sberbank"

It should be noted that sources analyzing the leak data indicate that it contained two files - 671,474 and 691,548 lines. Moreover, in addition to the names, email addresses and phones recognized by the court, they also contain password hashes. Analysis of these credentials from more than 9.5 thousand pairs of email and password hash showed that 60% of them are unique. The leak dates back to no earlier than February 3 and no later than February 28, 2023.

At the same time, as a possible reason for the data leak, the court ruling cites the defendant's version: "compromising the administrator's password for access to the personal account of the SberLogistics virtual infrastructure management platform." This suggests that the virtual infrastructure administrator did not enable two-factor authentication - it is precisely designed so that a password leak does not lead to the possibility of outsiders logging in under it.

In principle, for administrators of personal data management systems, it is recommended not only to use popular methods of obtaining a one-time password using SMS confirmation or QR code, but to connect full two-factor authentication biometrics using either a hardware one-time password generator. Fortunately, now these technologies are already available enough for daily use. This is especially necessary in the case of using a cloud virtual infrastructure, which is available to any desired visitor. Internet Failure to comply with such methods of protecting the credentials of privileged users can lead to the above consequences.

2023: Data breach of hundreds of thousands of users and employees

At the end of February 2023, it became known about the leakage of data of hundreds of thousands of users and employees of the SberLogistics service. The company has begun a review.

According to the Data1eaks Telegram channel, which specializes in covering events related to high-profile information leaks, hackers posted two files with SberLogistics data in the public domain. One of them contains 671,476 lines with fields such as:

• Name of the client;
• Email (127,606 unique addresses);
• Telephone (668 601 unique numbers);
• Password hash with "salt";
• Other technical information.

Two files with SberLogistics data got into open access

The second file contains 691,550 lines with the following fields:

• Full name of the employee;
• Employee telephones (10,335 unique numbers);
• E-mail on the corporate domain sblogistica.ru;
• Branch and position data;
• Other technical information and operational actions.

Experts found that the data in the leak were received no earlier than February 3, 2023. According to them, hackers from the NLB group are behind the leak.

We check the information and its accuracy. Such messages arise often and, as a rule, are associated with fraudsters who are trying to sell compilations of old databases under the guise [1]of original ones, SberLogistics quotes Interfax as checking the statement of SberLogistics[1]

In turn, Sberbank said that various data related to the clients of the credit institution are presented on hacker resources on the Internet. These are compilations of various databases obtained as a result of hacking of contractor companies of Sberbank subsidiaries. There is no sensitive financial information in them, the bank assured.

They also added that, as a rule, speculation on leaks was provoked by fraudsters who trade in data compilations.^[2]

2022: Warehouse launch in Novosibirsk

SberLogistics launches a warehouse in Novosibirsk for SberMegaMarket sales, which was announced by the latter on May 17, 2022.

The warehouse leased by SberLogistics with a total area of 4300 sq.m. will be used as a sorting center or a point for receiving goods from SberMegaMarket sellers within the first mile, as well as a fulfillment center for storing goods with a large range of logistics services. The companies expect that the initiative will significantly reduce the delivery time of orders to marketplace customers in the region, and will also expand the partner network by involving local manufacturers and distributors in cooperation.

The class A warehouse is located at Dargomyzhsky Street, 8V and is equipped with the latest technological equipment for processing more than 20,000 cargo items and online storage of an assortment of more than 250,000 units of goods. For safe unloading and loading, seven pre-levellers are provided, including for unloading trucks. The warehouse is also equipped with a high-rise rack system - a shelf mezzanine for storing goods. Electric loaders and electric chips are provided for quick unloading and placement.

As of May 2022, companies in the field retail e-commerce are rapidly reorganizing processes, solving problems with logistics, demand forecasting and delivery. You can maintain the availability of goods for consumers and support sales by using a completely ready-made marketplace infrastructure. Novosibirsk is a large Siberian city, the demand for buyers in which we are growing multiple times. Thus, the number of orders for SberMegaMarket Novosibirsk region from residents in the 1st quarter of 2022 increased by 3268% compared to the same period in 2021. We hope that the active launch of the warehouse and the opportunities we offer will contribute to the development of local sellers and allow us to become more competitive in the region in terms of delivery speed and service quality, said Anton Sizemin, Head of Sales Marketplace SberMegaMarket.

{{quote 'Novosibirsk is one of the priority regions for the development of our company's business. Providing the full range of logistics and warehouse services, we contribute to the development of e-commerce not only in Novosibirsk and the Novosibirsk region, but also enable buyers of the entire Siberian region to receive orders in the shortest possible time. Cooperation with our company will give the business community of the region a number of indisputable advantages - receiving orders through its own network of checkpoints and parcel delivery points, located within walking distance of the buyer, good courier delivery, refined operational processes that allow you to maintain a high level of quality and flexible pricing approach. I am sure that together we will be able to give a new impetus to business development to local manufacturers and sellers, - said Maria Zaytseva, Deputy General Director for Commerce of SberLogistics. }}

2021: More than 8,000 postamates installed

The federal logistics operator SberLogistics has crossed the mark of 8,000 posts throughout Russia. Sberbank announced this on July 7, 2021. In the capital, as of July 2021, there are more than 400 checkpoints and 415 points for issuing orders in Sberbank branches.