The State Bank of India (SBI) has identified 3,897 customer records containing personal information in data suspected to have been exposed on the dark web. The country’s largest lender has launched an investigation to verify the authenticity, source and extent of the alleged data leak.
In a regulatory filing on Wednesday, October 21, SBI said it had received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
A preliminary analysis of approximately 3.75 lakh records found on the dark web identified 3,897 records containing personally identifiable information (PII).
What Information Was Allegedly Exposed?
According to SBI, the records reportedly contained customers’ names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses.
The information also included branch details, Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan applications, lead records and other related files.
The bank is investigating whether the data is authentic and complete, how it may have been obtained and whether the exposure could pose risks to customers.
The suspected leak follows claims by an unidentified hacker group operating under the name “Siriusim”, which allegedly obtained confidential customer information linked to SBI. The group reportedly claimed to possess around 3.8 lakh data entries in CSV format and 2,722 PDF documents.
Cybersecurity monitoring account CyberPulse56 highlighted the claims on social media platform X. However, the authenticity and origin of the alleged dataset remain unverified.
SBI Activates Cybersecurity Response
SBI said it had activated its cyber incident response and containment protocols after receiving the alerts.
The bank has also engaged an independent cybersecurity agency empanelled by CERT-In to assess the suspected compromise, determine its possible extent and evaluate potential risks to customers and the institution.
The lender said it was implementing remedial and preventive measures as required.
In its regulatory filing, SBI stated that the incident had no material impact on its core business operations, financial performance or business continuity.
“The Bank’s core business functions continue to operate normally without disruptions,” the lender said.
Does the Suspected Leak Mean Bank Accounts Were Hacked?
The identification of personal information in the suspected leak does not necessarily mean that customers’ bank accounts have been accessed or that money has been stolen.
SBI’s preliminary findings concern personal details and loan-related information. The available information does not establish whether account passwords, PINs, transaction details or other banking credentials were compromised.
However, exposed personal information could potentially be misused for targeted scams. Fraudsters may use names, phone numbers, addresses or loan-related details to impersonate bank employees and persuade customers to reveal confidential information.
Customers should remain alert to unexpected calls, messages and emails claiming to be from SBI. They should never share one-time passwords (OTPs), PINs or passwords, and should verify suspicious requests through the bank’s official channels.
Anyone who notices an unauthorised transaction should contact SBI immediately and report suspected cyber fraud through India’s national cybercrime helpline at 1930 or the official portal, cybercrime.gov.in.
Investigation Into Data Exposure Continues
SBI said the investigation would examine the authenticity, source and extent of the suspected exposure. The bank also said it would continue monitoring the situation and take appropriate action in accordance with applicable regulatory requirements.
