SBI Confirms Limited Data Breach After 3,897 Customer Records Surface on Dark Web

Photo: IANS

State Bank of India has confirmed a data breach after 3,897 customer records were found exposed on the dark web, the country's largest lender said in an exchange filing on Wednesday.

The bank said it received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In earlier in the week about a suspected exposure of customer data. During a preliminary analysis of roughly 375,000 records circulating on the dark web, SBI identified 3,897 that contained Personally Identifiable Information.

The exposed data reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and metadata tied to loan and lead records.

SBI said it moved quickly to activate its cyber incident response and containment protocols and brought in an independent CERT-In-empanelled cybersecurity agency to carry out a full assessment and investigate the nature and extent of the compromise. A detailed investigation is now under way to establish the authenticity and completeness of the exposed data, trace its possible source and assess the associated risks.

The bank stressed that the incident has no material impact on its core business operations, financial performance or business continuity, and that core functions are running normally without disruption. Appropriate remedial and preventive measures are being put in place.

The disclosure follows claims earlier in the week by an unidentified hacker group calling itself "Siriusim," which said it had obtained confidential customer information allegedly linked to SBI, including personal details, loan applications and account-opening documents. The claim was flagged by cybersecurity monitoring account CyberPulse56 in a post on X, which said the group purported to hold 3.75 lakh data entries in CSV format along with 2,722 PDF documents tied to the public sector lender.

News of the breach did little to move SBI's stock, which traded flat at around Rs 970 on the BSE by mid-morning on Wednesday. The shares have ranged between a 52-week high of Rs 1,234.80 and a low of Rs 891.55, and have fallen about 12 per cent over the past year even as they have gained over a five-year horizon.

The episode puts fresh attention on cybersecurity at India's public sector banks, which hold vast troves of customer data and have increasingly found themselves in the crosshairs of threat actors. While the confirmed exposure is a small fraction of the records the hackers claimed to possess, the presence of loan-related documents and identity details raises concerns about phishing and identity fraud risks for affected customers.