New Delhi: State Bank of India has identified 3,897 customer records containing personal information during a preliminary examination of approximately 3.75 lakh records circulating on the dark web. The disclosure on Wednesday has raised concerns about possible financial scams, although there is no confirmed evidence that banking passwords were exposed or customer funds stolen.
In its stock-exchange filing, SBI said it received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
The incident first attracted public attention after cybersecurity monitoring account CyberPulse56 flagged claims by a threat actor identified as Siriusim on October 16. The actor claimed on the online forum BreachForums to possess approximately 3.75 lakh data entries and 2,722 PDF documents, allegedly including customer information, loan applications and account-opening records.
However, SBI has not identified the group as responsible, and the authenticity and origin of the entire dataset remain under investigation.
The exposed information reportedly includes names, registered mobile numbers, dates of birth, gender, email and residential addresses, branch details, Customer Information File (CIF) identifiers, lead IDs and information linked to loan applications.
Importantly, 3.75 lakh represents the records examined, not the number of confirmed affected customers. SBI has identified 3,897 records containing personal information, but the authenticity, completeness and full extent of the dataset remain under investigation.
Are SBI customer accounts at risk?
The exposure of personal information does not automatically mean bank accounts have been hacked. In a statement posted on X on Wednesday, SBI said: “Customer balances are completely safe and we are taking all possible steps to protect the interests of our valued customers.”
“We reiterate that safety of our customers’ financial assets, data and their trust in us remain our highest priorities,” the bank added. However, the statement did not specifically clarify whether banking passwords, personal identification numbers (PINs) or one-time passwords (OTPs) were exposed.
Personal details can make financial scams more convincing. Fraudsters could impersonate bank employees, refer to a customer’s branch or loan application and attempt to obtain confidential banking credentials.
Such attempts may involve fake Know Your Customer (KYC) updates, fraudulent loan offers or account-suspension warnings. No financial fraud directly linked to this incident has been publicly established.
SBI said it activated cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to investigate the suspected breach.
The bank maintained that its core operations, financial performance and business continuity remained unaffected. The bank maintained that its core operations and business continuity remained unaffected.
What should SBI customers do?
Customers should never share OTPs, ATM PINs or internet banking passwords, even with callers claiming to represent SBI. Suspicious messages should be verified through official banking channels, while unexpected links and requests for personal information should be avoided.
Customers should also monitor transactions and immediately report suspicious activity to their bank. Financial cyber fraud can be reported through India’s 1930 helpline or the national cyber crime reporting portal.
Meanwhile, the Internet Freedom Foundation has urged SBI to directly notify affected customers, pointing out that the bank’s disclosure did not clarify whether individuals had been informed.
India’s digital personal data protection act includes provisions requiring notification of affected individuals, but these obligations are scheduled to take effect in May 2027.
For now, the central questions concern how the information became exposed, whether more customer records are involved and what additional safeguards will follow the investigation.