State Bank of India (SBI) has started individually informing customers whose data was identified in a suspected cyber incident, reassuring them that their money remains safe even as it investigates the possible exposure of personal information.
“Further to our earlier post regarding the recent cyber incident, the Bank has individually informed all customers, whose data was identified as being involved, through email and/or WhatsApp,” SBI said in an advisory to customers on Friday.
The bank reiterated that “your account balances and funds are safe with us” and urged customers to be cautious while using digital banking services.
SBI data leak: What the bank has told customers
“Customers are advised to follow safe digital banking practices, never share their OTP, PIN or password with anyone, and remain vigilant against suspicious calls, messages and emails,” the advisory said.
Also Read: SBI weighs data leak impact, alerts cyber cover provider
The communication follows SBI’s disclosure of a suspected data leak involving customer records found on the dark web. In a preliminary examination of around 3.75 lakh records, the bank identified 3,897 records containing personally identifiable information, according to its stock exchange filing.
The information reportedly included customers’ names, registered mobile numbers, dates of birth, email IDs and residential addresses, along with branch and customer identification details and metadata linked to loan and lead records.
SBI cyber incident: How the bank responded
SBI received alerts about the suspected exposure on October 16 from its threat-intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). It activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency empanelled with CERT-In to investigate the incident.
The bank has said the incident has had no material impact on its core business operations, financial performance or business continuity. The investigation is expected to establish the authenticity and extent of the exposed information, its possible source and the risks involved.