SBI’s preliminary analysis of around 3.75 Lakh records on the dark web identified 3,897 customer records containing personal information
The exposed information includes contact details and customer identifiers, while the source and full extent of the exposure remain under investigation
SBI has engaged an independent CERT-In-empanelled cybersecurity agency to investigate and said its core banking operations remain unaffected
State Bank of India (SBI) has flagged the exposure of 3,897 customer records containing personal information on the dark web, including mobile numbers, dates of birth, email addresses, and residential addresses.
The public sector lender, in an exchange filing, said its preliminary analysis of around 3.75 Lakh records available on the dark web identified 3,897 customer records containing personally identifiable information.
The data also included branch details, customer information file identifiers, lead IDs, and metadata associated with loan and lead records, according to the bank.
SBI said it received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In).
The disclosure follows claims attributed to a threat actor using the name Siriusim, which cybersecurity account CyberPulse56 shared on X. The actor claimed to possess around 3.75 Lakh rows of SBI-linked data and 2,722 PDF documents, including loan applications, supporting documents, and account-opening forms. Inc42 could not independently verify these claims.
The number of records examined does not establish that 3.75 Lakh customers were affected, with SBI’s preliminary findings identifying 3,897 customer records containing personal information.
SBI said it had activated its cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to investigate.
The investigation will seek to establish the authenticity and completeness of the data, identify the source and extent of the exposure, and assess potential risks to customers and the bank.
The lender said its core banking and business functions continued to operate normally, with no material impact on operations, financial performance, or business continuity. It added that remedial and preventive measures were being implemented while the assessment continued.
The incident comes amid growing concerns over AI-driven cybercrime and digital fraud. State-run Punjab National Bank (PNB) has also warned customers about threats such as AI-generated voice clones, deepfakes and phishing attacks.
The SBI incident follows other customer data breaches at Indian financial services companies. In February last year, Angel One disclosed unauthorised access to some of its Amazon Web Services resources after receiving alerts from its dark-web monitoring partner.
Prior to that, personal data belonging to over 3 Cr Star Health customers surfaced for sale online, including names, addresses, PAN details, and medical histories. The insurer reported the breach to CERT-In and the insurance regulator, initiated a forensic investigation, and moved court to restrict access to the leaked information.
Source: Inc42
