The State Bank of India (SBI), the country’s largest lender, has reported a suspected cyber breach involving 3,897 customer records containing personally
identifiable information (PII) that has been exposed on the dark web.
In a disclosure to the stock exchanges on Wednesday, SBI said a preliminary examination of around 3.75 lakh records available on the dark web had identified 3,897 records containing personal information of the bank’s customers.
The exposed data reportedly includes customers’ names, gender, registered mobile numbers, date of birth, email IDs and residential addresses, along with branch and Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan and lead records.
The bank said it received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure.
SBI said the incident had no material impact on its business operations, financial performance or business continuity. “The bank’s core business functions continue to operate normally without disruptions,” it said.
While stating that it has activated cyber incident response and containment protocols, the lender did not, however, specify what steps it had taken to notify affected customers or protect them against potential misuse of the exposed information.
SBI said it would continue to monitor the situation and take appropriate measures in line with applicable regulatory requirements. An independent cybersecurity assessment is underway, and remedial and preventive measures are being implemented as required, the bank said.
The disclosure follows a claim by an unidentified hacker group operating under the name Siriusim that it had obtained confidential customer information allegedly linked to SBI, including personal details, loan applications and account-opening documents.
Cybersecurity monitoring account CyberPulse56 flagged the claim in a post on X on October 16. According to the account, the group claimed to possess 3.75 lakh data entries in the CSV format — a plain-text file format used to store tabular data such as spreadsheets or databases — and 2,722 PDF documents associated with the lender.
In a statement on X, SBI said that the incident has impacted “a very very small number of customers” and that customer balances are completely safe.
A senior executive at a private-sector bank who oversees IT operations said banks typically follow a standard operating procedure once affected accounts are identified.
“Even as the forensic investigation is underway, banks have to typically force password and PIN resets, tighten transaction monitoring and fraud alerts, strengthen OTP and device-binding checks, and, most importantly, warn affected customers about the incident and the phishing attacks that may follow,” the executive told this newspaper on Wednesday.
Fraud risk
Cyber audit expert Sandeep Sengupta, director of the Indian School of Anti Hacking (ISOAH), pointed out that SBI had yet to disclose how the data had been compromised.
“If the root cause is not identified, similar attacks can happen again. While the bank has indicated that there is no impact on its operations, the exposure of customers’ addresses, mobile numbers and email IDs could make them targets of fraud. The compromised loan-related information could also make customers vulnerable to fraudulent calls relating to loans,” Sengupta told The Telegraph.
He added that the exposure of registered mobile numbers could create further risks because they are often linked to Unified Payments Interface (UPI) services. He advised affected customers to exercise caution and consider changing their registered mobile numbers after assessing the risk and taking appropriate safeguards.
Sengupta also flagged the implications of the Digital Personal Data Protection (DPDP) Act, which is scheduled to come into effect on May 13, 2027. He said the law could expose organisations to penalties of up to ₹250 crore for certain violations, underscoring the need for stronger cybersecurity safeguards.
Advocacy organisation Internet Freedom Foundation (IFF), in a post on X, called on SBI to inform every affected customer through SMS, email and letters sent to registered addresses in English, Hindi and regional languages. The communication, it said, should specify what information had been leaked and the precautions customers should take.
The organisation also called for a dedicated helpline and an online facility through which customers can check whether their data had been affected. Once the investigation is complete, SBI should disclose how the data left its systems, including whether a vendor or direct selling agent was involved, and publish a summary of the investigating agency’s findings, the IFF said.