A breach of Utair (Russia) was added to Have I Been Pwned’s breach database on 26 December 2025. It affected 401,400 accounts. Exposed: Passport numbers, Email addresses, Phone numbers, Dates of birth, Names and Addresses and more. The breach began on 21 March 2019, 2,472 days before it was reported.
Status
Confirmed breach
People affected
401,400 accounts
Reported
26 December 2025
Breach began
21 March 2019
Time to tell
2,472 days (the median in California’s notices over the last year: 154 days)
Look for Utair’s own notice or letter: it should say what of yours was involved. Keep it.
An ID number cannot be changed, so lock it: a credit freeze or fraud alert in the US, a credit warning (kreditadvarsel) on borger.dk in Denmark, Cifas protective registration in the UK.
Expect scams that use your details: calls, texts or emails pretending to be Utair, your bank or the police. Never give codes or passwords, never approve a sign-in you did not start, never move money.
Privacy Unpacked