SBI Data Breach: Bank Confirms 3,897 Customer Records Exposed After Dark Web Claim

State Bank of India (SBI), the country's largest bank, has begun notifying customers whose data was exposed in a recent cybersecurity incident, after a hacker offered what it claimed was a large set of SBI customer data on a dark web forum. The bank says the number of affected customers is far smaller than the seller claimed, and that account balances and funds are safe.

The claim

On 16 October, an actor using the name Siriusim posted on BreachForums offering what it described as SBI customer data: 375,000 rows in CSV files and 2,722 PDF documents. According to India Today, the seller said the material included personal customer details, loan applications and supporting documents, account-opening forms, KYC records, Aadhaar numbers and residential addresses, and shared four sample records. Buyers were asked to pay in forum credits to download the files.

The row count is not a count of people. One customer can appear in several rows, and the claim did not say how many individuals the data covered.

What SBI found

According to reports of SBI's notice to the BSE and NSE stock exchanges on 21 October, the bank received alerts on 16 October from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about suspected exposure of customer data. A preliminary examination of around 375,000 records found on the dark web identified 3,897 customer records that contained personally identifiable information.

Reports say the bank has engaged an external cybersecurity firm approved by CERT-In to establish what was exposed. On 23 October SBI said it had contacted affected customers individually by email or WhatsApp. "We reiterate that your account balances and funds are safe with us," the bank said.

What is still not known

SBI has not said how the data was obtained, which systems held it, or when the exposure happened. It has not named a threat actor or said whether ransomware was involved. It is also not yet clear whether the material is new or was recycled from earlier leaks, which is common in data offered on these forums. The gap between the seller's 375,000 rows and the bank's 3,897 records has not been explained publicly.

What customers should do

Banking data of this kind is most useful to fraudsters for impersonation. A caller or message that already knows a customer's name, address, loan details or Aadhaar number can sound convincingly official.

• Never share an OTP, PIN, password or card details, whoever the caller says they are. SBI does not ask for them.
• Check any notice independently. If a message claims to be from SBI about the breach, contact the bank through the number on your card or the official YONO app, not a number or link in the message.
• Watch for loan and KYC scams. Leaked loan applications and KYC documents can be used to make fake loan offers or "KYC update" demands look real.
• Report suspected fraud to the bank and to the national cybercrime helpline (1930) or cybercrime.gov.in.