The State Bank of India (SBI) has confirmed the data breach involving 3,897 customer records that may have been exposed on the dark web. The information reportedly includes personally identifiable details such as names, mobile numbers, email addresses, dates of birth and residential addresses. In a filing with stock exchanges, the country’s largest public sector bank said it received alerts about the suspected data exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
SBI said its preliminary examination of approximately 3.75 lakh records found on the dark web identified 3,897 entries containing customer information. The exposed data also reportedly includes gender, branch details, customer information file identifiers, lead IDs and metadata associated with loan applications and other related records.
The bank has not confirmed the source of the exposure or established the full extent of the incident. It said further investigation would be needed to verify the authenticity and completeness of the data and assess the potential risks to customers.
SBI maintained that the suspected breach has not had a material impact on its core operations, financial performance or business continuity. The bank said its services continue to function normally and that it activated its cyber incident response and containment procedures after receiving the alerts.
The bank is monitoring the situation and said it would take appropriate action in line with applicable regulatory requirements as its investigation progresses. It must be noted that SBI has not publicly identified the party responsible for the suspected breach.
The disclosure follows an X post on October 19 about a potential SBI data breach. According to the reports, an anonymous group calling itself Siriusim claimed on the dark web forum BreachForums that it had obtained information relating to approximately 3.75 lakh SBI customers.
However, SBI has not attributed the incident to the group, and the claim has not been independently established. Interestingly, this is not the first time such a data breach has happened. In July, Bank of Baroda acknowledged a data leak involving approximately 1TB of customer data.