Key Points
- SBI identified 3,897 customer records containing personal data in 375,000 dark web records
- Exposed data includes mobile numbers, addresses, dates of birth and internal bank identifiers
- Account numbers, passwords, card details and Aadhaar numbers not among exposed categories
State Bank of India (SBI) has confirmed a data leak after identifying 3,897 customer records containing personal information in a dataset of approximately 375,000 records circulating on the dark web. The bank said it does not yet know the source of the data or whether the records are authentic.
SBI, India’s largest bank by assets, disclosed the incident in a stock exchange filing dated 21 October. The filing stated that the bank ‘has experienced an incident involving the loss of certain data.’ The count remains preliminary, and an investigation is under way to determine the extent of the exposure and the risk to customers.
The exposed information ‘reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files,’ according to the filing. A customer information file (CIF) identifier is the bank’s internal ID assigned to each customer.
The bank has not clarified whether the 3,897 records belong to 3,897 different individuals or what the remaining records in the dataset contain. The identified records represent roughly one in 100 of the records examined.
Data leak risks
Account numbers, balances, passwords, one-time passcodes, card details and government identity numbers such as PAN or Aadhaar are not among the categories the filing lists. The primary risk from the exposed categories is impersonation, where fraudsters use a customer’s name, mobile number, date of birth, address, branch and internal ID to construct phishing calls or messages that appear to originate from the bank.
SBI received the alert on 16 October through its threat intelligence provider, CERT-In and the Defence Cyber Agency, the armed forces’ cyber unit under the Ministry of Defence. The bank said it activated its incident response and containment procedures and engaged an independent cybersecurity firm from CERT-In’s panel of approved security auditors to assess what the filing calls ‘the alleged compromise.’
The filing states that the incident has no material impact on the bank’s core business operations, financial performance or business continuity. That assessment covers the bank’s business position, not the potential impact on affected customers.
The filing names no attacker, forum or dataset. The figure of approximately 375,000 records matches a claim flagged by the monitoring account CyberPulse56 on X on 16 October. The account reported that a threat actor using the name Siriusim claimed to have leaked customer documents and personal data linked to SBI, comprising 375,000 rows in CSV format and 2,722 PDF documents. The documents were said to include personal information, loan applications, supporting documents, account-opening forms and addresses.
The Free Press Journal examined the listing on BreachForums, a cybercrime marketplace used to trade stolen data, and found four sample records posted with the listing. The phone numbers in the samples were valid. The WhatsApp profile picture on one number matched the passport photograph on that person’s Know Your Customer (KYC) document, which the threat actor had also posted.
Source remains unclear
That verification covers four records and does not establish that the entire dataset is genuine or where it originated. The samples were mostly loan-related and carried KYC fields. They did not indicate whether the data belonged to SBI itself, one of its subsidiaries or a third-party provider that processes banking applications.
By the numbers
Key figures from this story- 3,897
- customer records identified in dark web dataset
- 375,000
- total records in dark web dataset examined
- 2,722
- PDF documents allegedly leaked with dataset
Nothing in the bank’s filing ties its analysis to the BreachForums listing. The bank has not said whether the 2,722 PDF documents formed part of what it examined. Whether any SBI system was directly breached remains an open question. The filing leaves the source of the data to the ongoing investigation and provides no date for when the data first appeared on the dark web.
The filing does not mention whether affected customers have been notified or will be informed. SBI’s cybersecurity page, last updated in June, advises customers to report any cyber incident to [email protected] or the national cybercrime helpline, 1930. That guidance predates the current incident.
Bank of Baroda, another state-owned bank, disclosed a cybersecurity incident in a stock exchange filing on 27 July using nearly identical language, including the phrase ‘the alleged compromise.’ That filing stated the bank received ‘a communication from an anonymous source claiming access to certain data’ and named a preliminary cause as ‘potential business email compromise.’ SBI’s filing identifies no cause.
Your Questions, Answered
What customer data was exposed in the SBI data leak?
According to SBI's filing, the exposed data reportedly includes mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch identifiers and internal customer ID numbers. Account numbers, passwords, card details and Aadhaar numbers are not among the listed categories.
How many SBI customers are affected by this data breach?
SBI identified 3,897 customer records in a dataset of approximately 375,000 records on the dark web. The bank has not confirmed whether these represent unique individuals or whether the full dataset is authentic.
What should SBI customers do if they are concerned about this breach?
SBI's cybersecurity page advises customers to report incidents to [email protected] or the national cybercrime helpline 1930. Customers should be cautious of calls or messages using personal details to appear legitimate.
Does SBI know how the data was leaked?
No. SBI's stock exchange filing states the source of the data remains under investigation. The bank has not confirmed whether its systems were breached directly or whether the data came from a third party.
