New Delhi – The State Bank of India (SBI), the country’s largest lender, announced on Wednesday that a preliminary analysis of data circulating on the dark web identified 3,897 customer records containing personally identifiable information (PII). The bank said it has activated a detailed investigation to verify the authenticity, source and scope of the alleged exposure.
Scope of the alleged exposure
According to SBI’s exchange filing, the bank received alerts about a possible data leak on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT‑In). A subsequent review of roughly 375,000 records found on the dark web highlighted 3,897 entries that included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch identifiers, Customer Information File (CIF) numbers, lead IDs and metadata linked to loan and lead records.
Separately, an unnamed hacker collective calling itself “Siriusim” claimed responsibility for the breach. A cybersecurity monitoring account, CyberPulse56, posted on the social platform X that the group possessed around 3.8 lakh (380,000) data entries in CSV format and 2,722 PDF documents allegedly tied to SBI. The purported files were said to contain personal details, loan applications, account‑opening documents and supporting paperwork. The bank noted that the authenticity and origin of these claims remain unverified.
Bank’s response and investigation
SBI said it immediately triggered its cyber‑incident response and containment protocols. The lender also engaged an independent cybersecurity agency, empanelled by CERT‑In, to assess the alleged compromise and evaluate any potential risk to customers and the bank’s operations.
In its statement, SBI emphasized that the incident has not had any material impact on its core business operations, financial performance or business continuity. “The Bank’s core business functions continue to operate normally without disruptions,” the filing read. “A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required.”
The ongoing investigation will focus on confirming whether the data is authentic and complete, pinpointing the source of the exposure, and measuring the risks associated with the incident. SBI indicated that it will continue to monitor the situation and act in line with applicable regulatory requirements.
Broader cybersecurity context
The revelation arrives amid heightened scrutiny of cyber threats facing India’s financial sector. Earlier in the year, the Reserve Bank of India (RBI) tightened cybersecurity mandates for commercial banks, urging stronger safeguards, incident‑response frameworks and regular vulnerability assessments.
Industry observers have warned that the rapid digitisation of banking services, accelerated by the pandemic, has expanded the attack surface for cybercriminals. While SBI has not disclosed any evidence that the data was used fraudulently, the bank’s swift response underscores the sector’s growing emphasis on resilience and transparency.
Regulators and cybersecurity agencies have repeatedly highlighted the importance of information sharing between banks, government bodies and private threat‑intelligence firms. In SBI’s case, the initial alert came from a coordinated effort involving its own threat‑intelligence partner, the Defence Cyber Agency and CERT‑In, illustrating the multi‑stakeholder approach promoted by the RBI’s recent guidelines.
Customers potentially affected by the leak have not been individually notified, as the bank is still assessing the completeness of the dataset. However, SBI’s public communication reiterates that no disruption to services such as deposits, withdrawals or loan processing has been observed.
Analysts note that even when a breach does not immediately affect operations, the exposure of personal data can increase the risk of phishing, identity theft and targeted fraud. They recommend that customers remain vigilant, monitor account activity and consider updating passwords or authentication methods where applicable.
As the investigation proceeds, SBI said it will keep stakeholders informed of any material developments. The bank’s statement also reaffirmed its commitment to complying with all regulatory mandates and to implementing any additional safeguards deemed necessary by the independent cybersecurity assessment.
While the full ramifications of the alleged data leak remain to be determined, the episode highlights the persistent challenge of protecting sensitive financial information in an increasingly interconnected digital environment.
Be First to Comment