The State Bank of India (SBI), the country’s largest lender, has flagged suspected exposure of customer data on the dark web, with a preliminary analysis identifying 3,897 customer records containing personally identifiable information (PII), according to a disclosure to the stock exchanges.
The bank received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure of customer data on the dark web.
A preliminary analysis of around 375,000 records available on the dark web identified 3,897 customer records containing personal information.
The information included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs, and metadata associated with loan and lead records.
SBI said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the risks to customers and the bank.
Also Read
The lender activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the alleged compromise.
A detailed assessment is under way, and the bank said it was implementing appropriate remedial and preventive measures, as required.
The bank said the incident had no material impact on its core business operations, financial performance or business continuity, adding that its core business functions continued to operate normally.
“We wish to submit that this does not have any material impact on Bank’s Core business operations, financial performance or business continuity,” the bank said.