The personal details of millions of Sberbank customers may have been leaked, in what would be the largest-ever data breach in Russian banking, according to cyber security experts.

Analysts at cybersecurity firm DeviceLock found personal information relating to up to 60 million Sberbank credit card holders for sale on the black market. They were able to analyse the data of around 200 supposed customers — provided to them by the seller — and verified their authenticity.

Russian newspaper Kommersant further verified some of the data by successfully finding the credit card details of its own journalists in the database, including personal details such as their place of employment for the last three years.

“This is the largest and most detailed banking database that has ever appeared on the black market,” DeviceLock founder Ashot Oganesyan said.

“In the world ranking of bank leaks, this can be considered a large incident. For the Russian market, this is an absolute record, at least for the last ten years,” he told The Moscow Times.

The data appeared for sale on a website which is blocked by Russia’s communications regulator Roskomnadzor. It is thought the data breach could have occurred at the end of August.