SBI Data Leak: Around 4,000 Customer Records Found on Dark Web
The State Bank of India (SBI) has launched an investigation after identifying 3,897 customer records containing personally identifiable information (PII) among data suspected to have surfaced on the dark web.
The country’s largest lender said it received alerts about the alleged exposure on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In. As part of an initial assessment, SBI examined around 3,75,000 records found on the dark web and identified 3,897 records containing customer PII.
“During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files,” the bank stated.
The information reportedly includes names, dates of birth, gender, registered mobile numbers, email addresses and residential addresses. Some records also contained branch and Customer Information File (CIF) identifiers, lead IDs, as well as metadata linked to loan and lead applications.
SBI has activated its cyber incident response and containment procedures and brought in an independent cybersecurity agency empanelled by CERT-In. The agency is assessing whether the alleged data is genuine, where it may have originated and how extensive the exposure could be.
Hacker group’s claim remains unverified
The development follows a claim by an unidentified hacker group calling itself ‘Siriusim’. The group allegedly claimed to have obtained confidential SBI customer information, including personal details, loan applications and account-opening documents.
Cybersecurity monitoring account CyberPulse56 drew attention to the claim in a post on X. According to the account, Siriusim allegedly held about 3.8 lakh data entries in CSV format along with 2,722 PDF documents linked to SBI.
The alleged material reportedly included customer details, addresses, loan applications, supporting documents and other application-related information. CyberPulse56 first reported the claim on October 16, saying Siriusim had presented it as its first disclosure of the dataset.
However, the authenticity and source of the alleged data exposure have not yet been verified.
SBI says operations continue normally
SBI said the incident has not materially affected its core operations, financial performance or business continuity.
“We wish to submit that this does not have any material impact on Bank’s Core business operations, financial performance or business continuity. The Bank’s core business functions continue to operate normally without disruptions. A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required,” the lender said.
The bank said it will continue monitoring the situation and take further remedial and preventive steps as necessary and in line with applicable regulatory requirements.