SBI Flags 3,897 Customer Records on Dark Web

The warning reached State Bank of India from three directions at once. On 16 October, the bank’s threat-intelligence provider, India’s Defence Cyber Agency and the national computer emergency team CERT-In all alerted it to what looked like its customers’ data for sale on the dark web. Five days later, India’s largest lender told the stock exchanges what it had found so far.

In a filing to BSE and NSE dated 21 October, SBI said a preliminary analysis of approximately 375,000 records available on the dark web identified 3,897 customer records containing personally identifiable information. The bank describes it as a “suspected exposure” and says it is still working out whether the data is authentic and complete and where it came from. Its filing is headed “Incident involving Data Loss”, and it says the bank “has experienced an incident involving the loss of certain data”.

Loan-lead records carry names, birth dates and addresses

According to the filing, the exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses and home addresses, along with branch and customer information file (CIF) identifiers, lead IDs and metadata associated with loan and lead records.

SBI said it “promptly activated its cyber incident response and containment protocols” and engaged an independent cybersecurity agency empanelled by CERT-In “to investigate the nature and extent of the alleged compromise”. It stressed that the incident “does not have any material impact on Bank’s Core business operations, financial performance or business continuity”, and that a detailed assessment is under way with remedial and preventive measures being put in place.

The filing does not say how the records got out, whether through SBI’s own systems or a partner, and it does not say whether affected customers will be contacted.

The disclosure follows a claim on a hacker forum

India Today said it first reported a potential breach at SBI on 19 October, after a group calling itself Siriusim claimed on the BreachForums site to hold the bank’s customer data. SBI’s filing names no group, and the bank has not linked the records to any particular attacker.

The 375,000 figure is the size of the dataset SBI’s investigators examined, not a count of affected customers. So far the bank has identified 3,897 customer records containing personal data within it, and the investigation is meant to establish whether that number changes.

Indian lenders face a run of warnings

The disclosure lands in a tense week for Indian finance. The Economic Times noted that Central Bank of India reported a technical glitch in its RTGS outward payment system between 15 and 17 October, though it has not attributed that to a cyberattack and said no customer lost money. On 9 October, CERT-In and the financial sector’s CSIRT-Fin issued a critical advisory about attack campaigns against non-bank lenders, fintechs and payment firms, ET reported.

CERT-In followed on 15 October with a separate advisory on AI agents being used as attack vectors, which TSN covered at the time. Nothing in SBI’s filing links its incident to either advisory.

For SBI’s customers, the next answer depends on the independent agency’s findings: whether the 3,897 records are genuine, where they came from and whether more of the dataset turns out to be SBI customer data. The bank says it will act “in accordance with applicable regulatory requirements” as that assessment continues.