SBI Data Leak: In a development that has drawn significant attention across India’s financial sector, the State Bank of India (SBI), the country’s largest public sector lender, has confirmed that nearly 3,897 customer records containing personally identifiable information (PII) were identified in data suspected to have been exposed on the dark web.
According to official exchange filings and media reports, the breach investigation was initiated after the bank received threat intelligence alerts regarding a massive repository of customer and loan metadata circulating online.
How the Breach Was Discovered and Investigated
SBI Data Leak: According to official statements issued by SBI, the lender received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In).
A preliminary analysis of roughly 3,75,000 records available on the dark web revealed that 3,897 specific customer records contained sensitive PII. The exposed fields reportedly included:
Customers’ full names and registered mobile numbers
Dates of birth and gender
Residential addresses and email addresses
Branch and Customer Information File (CIF) identifiers
Lead IDs and metadata associated with loan and lead records
Following the alerts, SBI activated its cyber incident response and containment protocols. Furthermore, the lender engaged an independent cybersecurity agency empanelled with CERT-In to conduct a thorough assessment, establish the authenticity and completeness of the exposed data, and determine its original source.
Hacker Group Claims and Cybersecurity Concerns
SBI Data Leak: According to media reports and cybersecurity monitoring accounts on social media platforms, an unidentified hacker group operating under the alias ‘Siriusim’ claimed responsibility for possessing confidential customer details.
The group allegedly held approximately 3.8 lakh data entries in CSV format along with over 2,700 PDF documents linked to the bank.
Cybersecurity experts cited in media coverage warned that while the leaked records do not expose core bank account passwords, PINs, or direct transaction credentials, the availability of personal identifiers, addresses, and loan applications creates significant vulnerability for social engineering attacks, identity theft, and targeted phishing.
Industry experts note that such datasets often originate from peripheral systems such as loan origination platforms, third-party sourcing vendors, or shared employee portals rather than a direct breach of the bank’s core banking infrastructure.
SBI Clarifies Status of Core Operations
SBI Data Leak: Amid growing concerns among account holders, SBI assured the public and stock exchanges that the incident has had no material impact on its core business operations, financial performance, or business continuity.
The bank emphasized that its primary banking services continue to operate normally without any technical disruptions.
The lender stated that it is closely monitoring the situation and implementing appropriate remedial and preventive measures in strict accordance with regulatory requirements set by the Reserve Bank of India (RBI).
What Account Holders Should Do
Security analysts emphasize that an exposure of personal and loan metadata does not automatically mean bank accounts have been compromised or funds stolen. However, customers are advised to exercise heightened caution:
Beware of Phishing Calls: Fraudsters may use leaked names, mobile numbers, and loan details to sound authentic. Never share One-Time Passwords (OTPs), PINs, or passwords with callers claiming to represent SBI.
Monitor Account Activity: Keep SMS and email transaction alerts active and review bank statements regularly.
Use Official Channels: Always access banking services through official apps, verified websites, or physical branches.
Report Suspicious Incidents: If you encounter suspected financial fraud, report it immediately to India’s national cybercrime helpline at 1930 or via the official cybercrime reporting portal.