New Delhi: The State Bank of India (SBI) is investigating a suspected data breach after thousands of customer records containing personally identifiable information were found among a larger dataset circulating on the dark web.
In a disclosure to stock exchanges on Wednesday, October 21, the country’s largest public sector lender said its preliminary analysis of approximately 3.75 lakh records available online had identified 3,897 customer records containing personal information.
The bank said it received alerts about the suspected exposure on October 16 from its threat-intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). It subsequently activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled with CERT-In to investigate the incident. <Cite refs={[“turn234636view0″,”turn529307search0”]}/>
What SBI Customer Information Was Exposed?
According to the bank’s disclosure, the 3,897 identified records contained personally identifiable information. The data reportedly included:
- Customers’ names and gender
- Registered mobile numbers and dates of birth
- Email addresses and residential addresses
- Branch details and customer information file (CIF) identifiers
- Lead IDs and metadata associated with loan and lead records
The exposure raises concerns about how personal information could potentially be misused for targeted scams or impersonation. Fraudsters may use genuine personal details to make calls, messages or emails appear more credible.
However, the bank has said further investigation is required to establish the authenticity and completeness of the exposed data, identify its possible source and determine the full extent of the incident.
The preliminary figure of 3,897 records should therefore not be interpreted as a final assessment of the breach.
Has SBI’s Banking System Been Affected?
SBI said the incident had not materially affected its core business operations, financial performance or business continuity.
The bank stated that its core functions continued to operate normally while the investigation was underway. It also said it was monitoring the situation and would take appropriate measures in accordance with applicable regulatory requirements.
The disclosure does not establish that customers’ bank accounts were accessed or that money was stolen as a result of the incident. The confirmed scope of the preliminary analysis concerns records containing personal information, while the investigation is expected to clarify the source and potential risks associated with the exposure.
How Did The SBI Data Leak Come To Light?
SBI’s disclosure followed reports of a dataset allegedly linked to approximately 3.75 lakh customers appearing on the dark web.
India Today Tech had reported a potential breach on October 19, citing claims by an anonymous threat actor identified in reports as Siriusim. The actor allegedly claimed to have obtained SBI-related information and documents.
SBI has not publicly identified the group responsible, and the available information does not establish who obtained or published the data.
The bank’s investigation is expected to determine whether the records are authentic, how they were exposed and whether additional information was compromised.
What Should SBI Customers Do Now?
While the investigation continues, customers should be cautious about unsolicited calls, emails, text messages and WhatsApp communications that refer to their banking details or loan applications.
Customers should avoid sharing one-time passwords (OTPs), PINs, passwords or other authentication credentials with anyone claiming to represent a bank. They should also avoid clicking suspicious links or downloading unexpected attachments.
Anyone who notices an unauthorised transaction should contact SBI through its official channels and report suspected cyber fraud promptly through India’s national cybercrime reporting system.
The incident highlights the importance of protecting personal information even when a bank’s core systems continue to function normally. SBI’s ongoing investigation will be crucial in determining the extent of the exposure and the measures required to address the risks to affected customers.
