NEW DELHI: The State Bank of India (SBI) on Wednesday said that it has identified 3,897 customer records containing personally identifiable information (PII) in data suspected to have been exposed on the dark web. The bank has launched a detailed investigation to establish the authenticity, source and extent of the alleged exposure.In an exchange filing, the country’s largest lender said it received alerts about the suspected exposure on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In. A preliminary analysis of approximately 3,75,000 records available on the dark web found 3,897 records containing PII.“During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files,” the bank stated.SBI said it had activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to assess the alleged compromise and the potential risks to customers and the bank.The lender clarified that the incident had no material impact on its core business operations, financial performance or business continuity, and that its core functions continued to operate normally.
Names, addresses and loan records: What the data contained
The information identified in the preliminary analysis reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. The records also contained branch and customer information file (CIF) identifiers, lead IDs, metadata associated with loan and lead records, and other related files.The ongoing investigation will examine whether the data is authentic and complete, determine the potential source and extent of the exposure, and assess the risks associated with the incident. SBI said appropriate remedial and preventive measures were being implemented as required.
What the hacker group has claimed
The bank’s statement follows a claim by an unidentified hacker group operating under the name ‘Siriusim’ that it had obtained confidential customer information allegedly linked to SBI, including personal details, loan applications and account-opening documents.Cybersecurity monitoring account CyberPulse56 highlighted the claim in a post on social media platform X. According to the account, the group purportedly possessed around 3.8 lakh data entries in CSV format and 2,722 PDF documents associated with the lender.The alleged dataset contained customers’ personal information, residential addresses, loan applications, supporting documents and other application-related records. CyberPulse56 first reported the claim on October 16, saying Siriusim had presented the material as its first disclosure of the dataset.However, the authenticity and origin of the alleged exposure remain unverified.
Business operations remain unaffected
SBI said it would continue to monitor the situation and take appropriate measures in accordance with applicable regulatory requirements. The independent cybersecurity agency’s assessment is underway, with remedial and preventive measures being implemented as required.“We wish to submit that this does not have any material impact on Bank’s Core business operations, financial performance or business continuity. The Bank’s core business functions continue to operate normally without disruptions. A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required,” the lender said.The alleged exposure comes amid broader concerns over cybersecurity risks facing India’s financial sector. Earlier this year, the Reserve Bank of India stepped up cybersecurity requirements for commercial banks.
