#4 trending2000+ searchesstate bank of india

State Bank of India confirms cyberattack: 3,897 customer records found on the dark web

By Trend Desk · · 3 min read

Conceptual illustration of a bank building and a broken digital padlock leaking data
Illustration (AI-generated)

State Bank of India, the country’s largest lender, is trending after it confirmed a cyber incident in which personal records of nearly 3,900 customers were found on the dark web. With SBI serving a huge share of Indian bank customers, the news sent many people searching to find out whether they are affected and what to do.

What SBI has disclosed

In a filing with the stock exchanges, reported by India Today and Reuters, SBI said it suspected the exposure of 3,897 customer records containing personally identifiable information.

According to India Today’s account of the filing:

  • On 16 October, SBI received an alert from its threat-intelligence service provider, the Defence Cyber Agency and CERT-In (the Indian Computer Emergency Response Team) about the suspected exposure.
  • A preliminary analysis of about 3,75,000 records found on the dark web identified the 3,897 customer records containing personal information.
  • The exposed data reportedly included registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses.
  • The records also contained branch and customer information file (CIF) identifiers, lead IDs and metadata linked to loan and lead records.

SBI said the incident had not materially affected its core operations, financial performance or business continuity. “The bank’s core business functions continue to operate normally without disruptions,” the bank said, adding that it “promptly activated its cyber incident response and containment protocols.”

The bank also said a detailed investigation is needed to establish the authenticity and completeness of the data, identify its source, determine the extent of the exposure and assess risks to customers.

The hacker group’s larger claim

The Times of India reported that an unidentified group calling itself “Siriusim” has claimed to hold confidential data linked to SBI — around 3.8 lakh data entries in CSV format and 2,722 PDF documents, including personal details, loan applications and account-opening documents. The claim was first flagged on 16 October by a cybersecurity monitoring account, CyberPulse56, on X.

TOI stressed that the authenticity and origin of that dataset remain unverified, that the number of entries does not show how many individuals are affected (one person can appear in several records), and that there had been no independent confirmation that SBI’s own systems were the source. India Today said it had first reported a potential breach at SBI on 19 October.

Put simply: SBI has confirmed 3,897 customer records with personal information; the hacker group’s larger numbers are claims that have not been verified.

Phone showing a security warning icon
Leaked contact details are often used for targeted phishing.

What this means for customers

The exposed fields — phone numbers, email addresses, home addresses and loan-related identifiers — are exactly what fraudsters use for convincing phishing calls, SMS and emails. TOI noted the warning that such data could be exploited for identity theft, financial fraud, targeted phishing and fraudulent loan applications.

Practical steps, whether or not you believe your data is involved:

  1. Never share OTPs, PINs, CVVs or passwords with anyone who calls or messages you, even if they quote your loan details or branch correctly.
  2. Be suspicious of “KYC update” or “loan verification” links. Use only the official SBI app or website you type in yourself.
  3. Turn on transaction alerts and review statements for anything unfamiliar.
  4. Check your credit report for loans or enquiries you did not make.
  5. Report suspected fraud quickly through your bank and India’s cybercrime helpline 1930 or cybercrime.gov.in.

The bigger picture

The incident comes amid broader concern about cybersecurity in India’s financial sector; TOI noted that the Reserve Bank of India stepped up cybersecurity requirements for commercial banks earlier this year. How SBI’s investigation concludes — and whether the source of the leak is traced to the bank, a vendor or elsewhere — will be closely watched by regulators and customers alike.

Sources