If the dataset attributed to Siriusim is found to be genuine and contains sensitive customer records, the information could potentially be misused for impersonation, phishing, identity theft or attempts to obtain loans fraudulently.
A cybersecurity monitoring account has flagged a claim that a threat actor identified as Siriusim has leaked customer documents and personal information allegedly associated with the State Bank of India. The authenticity of the claims and the extent of any potential customer-data exposure remain unverified.
CyberPulse56, in a post on social media platform X, reported the alleged data leak on October 16, 2026. The claimed dataset comprises 375,000 CSV rows and 2,722 PDF documents containing personal customer information, loan applications, supporting documents, account-opening applications, addresses and other application-related details.
The threat has reportedly described it as the first release of the dataset. However, the claim does not disclose the source of the allegedly leaked information.
If the dataset attributed to Siriusim is found to be genuine and contains sensitive customer records, the information could potentially be misused for impersonation, phishing, identity theft or attempts to obtain loans fraudulently.
Cyberattacks target financial institutions
The alleged SBI data leak claim comes amid reports of a series of cyberattacks targeting India's financial services sector.
The Economic Times reported on October 15, citing people familiar with the development, that as many as 20 financial institutions had been affected earlier in the month by a spate of cyberattacks. Funds were allegedly siphoned off using stolen credentials belonging to partner banks.
The incidents highlight the risks posed by compromised credentials and weaknesses in the systems connecting financial institutions, payment providers and digital lending platforms.
CERT-In warns of cyberattacks targeting fintech firms, digital lenders
Separately, the Indian Computer Emergency Response Team (CERT-In) issued an advisory on October 9 warning about multiple cyberattack campaigns targeting non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment service providers and digital wallets.
According to the advisory, attackers are compromising internet-facing applications, exposed application programming interfaces (APIs) and privileged endpoints to steal payment gateway and partner-bank credentials.
Using these credentials, threat actors directly invoke fund-transfer and disbursal APIs from within organisations' whitelisted infrastructure, bypassing safeguards such as KYC checks, loan approvals, beneficiary verification and transaction limits.
The fraudulent transactions reportedly use dummy reference identifiers and route funds to attacker-controlled mule accounts across multiple banks.