SBI Launches Forensic Probe After Nearly 4,000 Customer Records Surface on Dark Web
SBI Launches Forensic Probe After Nearly 4,000 Customer Records Surface on Dark Web #
State Bank of India (SBI), the country’s largest lender by assets, has disclosed a suspected cybersecurity incident after customer records containing sensitive personal information appeared on the dark web, according to an exchange filing.
In a preliminary assessment, SBI identified 3,897 customer records containing personally identifiable information (PII) within a broader dataset of approximately 375,000 entries analysed in an initial review. The compromised data reportedly includes customers’ names, registered mobile numbers, dates of birth, gender, email addresses, and residential addresses, as well as branch details, customer information file (CIF) identifiers, lead IDs, and metadata linked to loan and account-opening records.
SBI said it received alerts on 16 October from its threat-intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). The bank has since engaged an independent cybersecurity agency empanelled by CERT-In to carry out a forensic investigation and activated its incident-response and containment protocols. Remedial and preventive measures are being implemented while the assessment continues.
The suspected exposure was compounded by claims from an unidentified hacker group operating under the name “Siriusim,” which alleged possession of a larger collection of SBI-linked data. The cybersecurity-monitoring account CyberPulse56 publicised the group’s assertions on X on 16 October, citing an alleged dataset of around 380,000 CSV entries and more than 2,700 PDF files, including loan applications, account-opening documents, and supporting paperwork. The post was reportedly made on BreachForums, a dark web cybercrime forum. The authenticity and origin of the full dataset remain unverified, and no direct link to SBI’s systems or those of a third-party vendor has been confirmed.
SBI said the incident has no material impact on its core business operations, financial performance, or business continuity, and that its services are continuing normally. The bank’s ongoing investigation will seek to establish the authenticity and completeness of the exposed data, identify the potential source of the leak, and assess any associated risks to customers. Cybersecurity experts have cautioned that data of this type, which combines personal identifiers with loan-related records, could be exploited to craft convincing phishing attacks targeting affected customers.
Copy link