The claim was made by a threat actor identified as Siriusim, who allegedly posted customer-related information, including loan applications, account-opening documents, addresses, and other personal details.
However, the authenticity, source, and extent of the alleged data leak have not been independently verified. There is also no confirmation that SBI's systems were compromised.
In its October 16 post, CyberPulse identified SBI as the alleged target and listed the material that Siriusim claimed to possess.
‼️DATA LEAK CLAIM — STATE BANK OF INDIA 🇮🇳 A threat actor identified as Siriusim claims to have leaked customer documents and personal data allegedly associated with the State Bank of India (SBI). 🎯 Target: State Bank of India (SBI) 🌍 Country: India 🇮🇳 🏦 Sector: Banking / Financial Services 📅 Claim reported: October 16, 2026 Claimed dataset: ▪️ 375,000 CSV rows ▪️ 2,722 PDF documents ▪️ Personal customer information ▪️ Loan applications and supporting documents ▪️ Account-opening applications ▪️ Address and other application-related details ⚠️ The threat actor describes this as the first disclosure of the dataset. The authenticity, origin and extent of the alleged exposure remain UNVERIFIED. Potential impact: If legitimate, the data could facilitate identity theft, financial fraud, targeted phishing and fraudulent loan applications. SBI should investigate the claim, verify whether customer records were exposed and notify potentially affected customers through official channels. #CyberSecurity #India #SBI #StateBankOfIndia #DataLeak #DataBreach #BankingSecurity #ThreatIntelligence
— CyberPulse (@CyberPulse56) October 16, 2026
According to the cybersecurity firm, the purported dataset includes:
-375,000 rows of data in CSV format
-2,722 PDF documents
-Personal customer information
-Loan applications and supporting documents
-Account-opening applications
-Address details and other application-related information
The threat actor described the material as the first disclosure of the dataset, CyberPulse said.
The reported 375,000 rows do not necessarily represent 375,000 individual customers. It remains unclear whether the records are genuine, whether they contain duplicate entries or how the alleged data was obtained.
CyberPulse warned that if the information is authentic, its exposure could create serious risks for customers.
The firm identified identity theft, financial fraud, targeted phishing attacks and fraudulent loan applications as potential consequences.
Personal information contained in banking applications can be particularly sensitive because such documents may contain identifying details that criminals could misuse to impersonate customers or conduct financial scams.
CyberPulse explicitly cautioned that the alleged exposure remains unverified. "The authenticity, origin and extent of the alleged exposure remain UNVERIFIED," the firm said.
It also called on SBI to investigate the allegations, establish whether any customer records had been exposed and notify potentially affected customers through official channels.
The Economic Times reported on October 20 that SBI had not responded to its emailed request for comment at the time of publication.