Mumbai: The State Bank of India (SBI) is investigating the exposure of thousands of customer records on the dark web, with cybersecurity experts warning that the leak could leave affected customers vulnerable to targeted fraud and social-engineering attacks even if the bank's core systems and account balances remain secure.
In a regulatory filing to the stock exchanges on Wednesday, SBI said it had received alerts on 16 October from its threat intelligence service provider, the the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) about the suspected exposure of customer data on the dark web. A preliminary analysis of around 375,000 records found on the dark web identified 3,897 records containing personally identifiable information, including names, registered mobile numbers, dates of birth, gender, email and residential addresses, branch and customer identification details, lead IDs and metadata linked to loan and lead records. SBI said it has appointed an independent CERT-In-empanelled cybersecurity agency to assess the authenticity, completeness, origin and extent of the exposure.
The bank said the incident was not expected to have a material impact on its information technology systems, core business operations, financial performance or business continuity. It also said it had activated its cyber incident response and containment protocols after receiving the alerts.
Dhiraj Gupta, chief technological officer (CTO) and co-founder of cybersecurity firm mFilterIt, said the leaked information could give fraudsters enough detail to make scams more convincing.
“All of this data will allow fraudsters to build a profile of yours. They’ll be able to target you with precise information and use that to build your confidence,” Gupta said.
He cautioned customers against assuming that a caller is genuine simply because they know personal details. “The problem is that customers have to be careful that just because someone is saying all of this information, they cannot assume that person is genuine. This data is now out there and publicly available.”
SBI did not immediately respond to Mint's queries.
The SBI incident is the second major cybersecurity attack involving a public sector bank in recent months, following Bank of Baroda’s disclosure in July of a security incident involving unauthorised access to certain data after an employee’s email account was compromised. Bank of Baroda had also said its core banking systems were not accessed.
Mint had earlier reported that the Bank of Baroda incident came to light around the lender's June-quarter earnings and that the timing warranted scrutiny.
Gupta said such compromises can take place over an extended period as attackers move through systems. “These kinds of leaks happen over days and weeks. Someone will access the system, find more information, potentially find more access points, and then move into those systems and databases,” he said.
He also said ransomware could be one possible reason for the breach in such cases, while stressing that he had no information on whether that had happened in the SBI incident.
Another area that investigators may examine is third-party access. “A vendor compromise is always a possibility. Vendors have enough access these days, and that is why the RBI has mandated vendor audits. Banks are now required to audit themselves and their vendors for security compliance,” Gupta said.
Pavan Duggal, senior Supreme Court advovate and a cyber law expert, described the incident as serious given SBI’s scale and customer base. “This is not an ordinary breach. It is a serious matter that needs to be investigated thoroughly keeping in mind the size of SBI and number of accounts SBI holds,” he said.
He also pointed to the RBI’s cybersecurity and IT-governance framework, under which banks can face regulatory action and monetary penalties for specified non-compliance.
Later in the day, SBI issued a fresh statement on X seeking to reassure customers, saying the incident had affected a “very very small number of customers” and that “customer balances are completely safe.” The bank reiterated that the incident had no material impact on its IT systems, core operations, financial performance or business continuity, and said protecting customers’ financial assets, data and trust remained its highest priorities.
Gupta, however, said the consequences of exposed personal information could persist well beyond the immediate incident. “What has already left is now the customer’s problem for the next five years. But what they can do is strengthen their security to make sure that what has not left can still be protected.”
“Should this data breach take place after the DPDP Act 2023 fully comes into force from 13th May 2027, the bank would be liable to pay fines of ₹250 crore per contravention, payable to the Consolidated Fund of India,” said Duggal.