SBI Data Breach: Bank Finds 3,897 Customer Records in Dark Web Leak Claim

In its 21 October filing to India's BSE and NSE stock exchanges, State Bank of India (SBI) said a preliminary analysis of around 375,000 records on the dark web found 3,897 customer records with personal data in them. Those records held names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses.

The claim

India Today reported that an actor calling itself Siriusim posted on BreachForums claiming 375,000 rows in CSV files and 2,722 PDF documents from SBI. The claim, flagged on 16 October, listed personal customer information, loan applications with supporting documents, account-opening applications and address details. Siriusim also published what it said were four sample customer records.

SBI's response

SBI's exchange filing says the bank received alerts on 16 October from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). The bank has engaged an independent cybersecurity agency empanelled by CERT-In to assess the incident, and said core operations weren't affected.

On 23 October, in a statement posted on X, SBI said it had "individually informed all customers, whose data was identified as being involved, through email and/or WhatsApp".

"We reiterate that your account balances and funds are safe with us," the bank added.

What is still not known

SBI hasn't said how the data was obtained or which systems held it. Its filing doesn't mention the 2,722 PDF documents Siriusim claimed.

What customers should do

SBI's post on X asked customers never to share OTPs, PINs or passwords with anyone and to be wary of suspicious calls, messages and emails.