SBI reports data exposure involving 3,897 customer records on dark web

MUMBAI: A dark cloud has gathered over customer data security at the State Bank of India (SBI), after the country’s largest lender reported a suspected data exposure involving personally identifiable information (PII). A preliminary examination identified 3,897 customer records containing such information among approximately 3.75 lakh records found on the dark web, prompting the bank to launch an investigation into the incident.

In a disclosure dated 21 October under Regulation 30 of the Securities and Exchange Board of India’s (SEBI) Listing Obligations and Disclosure Requirements Regulations, 2015, SBI said it had received alerts about the suspected exposure on 16 October. The alerts came from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

The discovery raises questions about the possible circulation of sensitive customer information online, although the bank has cautioned that further investigation is required to establish the authenticity, completeness and origin of the data. The preliminary findings identify 3,897 records containing personally identifiable information; this should not be confused with confirmation that all approximately 3.75 lakh records found on the dark web belong to SBI customers or contain verified customer information.

The distinction is important as the bank works to determine the scale of the suspected exposure and whether the information could pose risks to customers.

The information identified in the preliminary examination reportedly includes customers’ names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. The records also contain branch identifiers and Customer Information File (CIF) identifiers, along with lead IDs, metadata associated with loan and lead records, and related files.

Such information can reveal more about an individual than a single contact detail. If authentic, combinations of names, phone numbers, email addresses and residential information could potentially be used to make fraudulent communications appear credible. Loan-related records and supporting documents could also carry additional risks, depending on their contents and whether they contain sensitive financial or identity information.

However, SBI has not yet established the authenticity and completeness of the exposed material or confirmed the full extent of any compromise. The investigation is expected to examine the possible source of the data, the nature of the exposure and the risks to both customers and the bank.

Following the alerts, SBI activated its cyber incident response and containment protocols. It also engaged an independent cybersecurity agency empanelled by CERT-In to assess the incident and investigate the nature and extent of the suspected compromise.

The bank said a detailed assessment was under way, with remedial and preventive measures being implemented as required. It also said it would continue monitoring the situation and take appropriate action in accordance with regulatory requirements.

The investigation will need to establish whether the records originated from SBI systems, whether the information was accessed or disclosed without authorisation, and how widely the material may have circulated. The information provided in the disclosure does not yet establish the precise mechanism behind the suspected exposure.

Despite the concerns surrounding the incident, SBI said its core business operations, financial performance and business continuity had not been materially affected. The bank added that its core functions continued to operate normally, without disruption.

The reported exposure follows claims by an unidentified hacker group operating under the name ‘Siriusim’, which allegedly obtained confidential customer information linked to SBI. The group reportedly claimed to possess personal details, loan applications and account-opening documents associated with the bank.

Cybersecurity monitoring account CyberPulse56 flagged the claim in a post on X, stating that the group purportedly held 3.75 lakh entries in CSV format and 2,722 PDF documents. According to the account, the alleged dataset included customer information, residential addresses, loan applications, supporting documents and other application-related records.

These figures form part of the reported claims about the dataset and should be distinguished from SBI’s preliminary finding of 3,897 records containing personally identifiable information. The available information does not independently establish that every file or entry cited by the monitoring account is authentic or that all of it was obtained from the bank.

For customers, the key concern is whether the information can be used to impersonate them or make fraudulent requests appear legitimate. Until the investigation establishes the nature and scope of the exposure, the potential risks remain subject to verification.

The incident also underlines the challenge facing financial institutions as they monitor threats beyond their own networks. Data circulating on the dark web can trigger alerts even when its origin, accuracy and route of disclosure are unclear, making verification and containment important parts of the response.

For SBI, the immediate task is to establish what the records contain, where they came from and whether any customer action is necessary. The bank has confirmed that an investigation is under way, but the extent and source of the suspected exposure remain unresolved.