State Bank of India (SBI) has disclosed a suspected customer data breach, saying it found 3,897 records containing personal information on the dark web. The country’s largest public sector lender confirmed the findings in a stock exchange filing on Wednesday and has launched a detailed cybersecurity investigation.
The bank said it received alerts from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In), all pointing to a possible exposure of customer information. In a preliminary review of around 3.75 lakh records circulating on the dark web, SBI identified 3,897 records containing personally identifiable information.
The disclosure follows a claim made last week by a threat actor using the name “Siriusim”. In a post on BreachForums, a site known for trading stolen data, the actor claimed to possess 3.75 lakh customer records and 2,722 PDF documents linked to SBI. The claim was flagged on October 16 by the X account CyberPulse56.
The listing described the data as a CSV file containing 3.75 lakh rows, along with the PDF documents. The poster also shared four sample records as evidence. The Free Press Journal examined the samples and found that the phone numbers were real. Most of the data appeared to relate to loans, while some entries concerned savings account applications and customer acquisition.
Following the alerts, SBI activated its cyber incident response protocols and engaged an independent cybersecurity agency empanelled with CERT-In. The agency will verify the authenticity of the leaked records, trace the source of the potential exposure and assess the associated security risks. The bank said it was implementing preventive and corrective measures.
Several questions remain unanswered, including how the data was obtained and how old it is. The listing did not specify whether the records were recent or linked to an earlier incident. SBI has not yet disclosed how many of the 3,897 records could be linked to current customers.
The nature of the information reportedly contained in the samples adds to the seriousness of the case. The records included identity verification documents, making the potential exposure more consequential than a typical leak of names and phone numbers. Unlike a stolen password, a compromised identity document can be difficult to replace and may carry longer-term risks.
The case also puts banks’ legal obligations around data protection under scrutiny. Under the Digital Personal Data Protection Act, organisations are required to implement reasonable security safeguards and notify authorities of personal data breaches. Violations of certain obligations can attract penalties of up to Rs 250 crore.
This is not the first time SBI has faced questions of this kind. In 2019, the bank rejected a TechCrunch report about an unprotected server, saying its own investigation showed there had been no breach.
This story will be updated as the investigation progresses.