/
SBI confirms 3,897 customers' records on the dark web after a hacker claimed 3.75 lakh
The State Bank of India told the stock exchanges on Wednesday that a preliminary check of about 3.75 lakh records posted online found 3,897 with personal details. It says the incident has no material impact. It has not said whether affected customers have been told.
A
4 min
The State Bank of India has confirmed that the personal details of 3,897 customers are among data circulating on the dark web, five days after a hacker posted a claim of far larger scale. In a filing to the BSE and NSE on Wednesday, 21 October, the bank said a preliminary analysis of about 3.75 lakh records had found 3,897 customer records containing personally identifiable information, roughly 1 per cent of the dataset.
The filing, made under Regulation 30 of the SEBI listing rules, says the bank received communications on 16 October from its threat intelligence provider, the Defence Cyber Agency, and from the Indian Computer Emergency Response Team, CERT-In, about the suspected exposure of customer data. SBI activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to carry out a full assessment. It says the incident "does not have any material impact" on its core business operations, financial performance or business continuity, and that it will take "all appropriate measures in accordance with applicable regulatory requirements".
What was exposed
The 3,897 records contain mobile numbers, dates of birth, names, gender, email addresses and residential addresses. They also carry branch and CIF identifiers, lead IDs and metadata linked to loan and lead records. The filing does not say what the remaining records, about 99 per cent of the file, hold, or whether any of them contain identity documents such as Aadhaar, PAN or passport details. It does not mention the 2,722 PDF documents that the hacker said it had.
On 16 October a threat actor calling itself "Siriusim" posted on BreachForums, a cybercrime forum known for trading stolen data, that it held 375,000 rows of CSV data and 2,722 PDF files tied to SBI and possibly its subsidiaries. The claim was flagged on X by a cybersecurity account the same day. The contents were said to include loan applications, supporting financial documents, account-opening forms, customer identification details and residential addresses.
The hacker published four sample customer records for free. They show names, dates of birth, mobile numbers, email addresses, residential details, occupations, nominees, branch information, CKYC numbers and video-KYC fields. One document is an income declaration form with employer, designation and salary. A check of the samples found that the phone numbers were valid, and that the profile photo linked to one of them matched the passport-size photograph in that person's KYC document, which suggests at least some of the data belongs to real people. It did not establish whether the whole file is genuine or how it was obtained.
The two numbers need to be kept apart. The 3.75 lakh figure counts rows in a file, and a row is not necessarily a separate customer. The 3,897 figure is the part of that file SBI has so far identified as customer data with personal details. It is not clear whether the data belongs to the bank, one of its subsidiaries or a third party that handles applications.
What the rules say
Under CERT-In directions of April 2022 a breach must be reported within six hours, with details added later. The Reserve Bank's cybersecurity directions for commercial banks, issued on 31 July 2026, require incidents to be reported through its DAKSH platform within six hours of detection. The Digital Personal Data Protection Act, 2023, requires notice to the Data Protection Board and to each affected individual, but the rule that spells this out takes effect only on 13 May 2027. The Internet Freedom Foundation notes that current obligations do not require banks to notify affected customers, and wants SBI to do so directly anyway, explaining what was exposed and what people should do. It also wants the RBI to direct regulated entities to notify customers and the IT ministry to bring the relevant provisions into force at once.
This is not the first such case this year. In July Bank of Baroda disclosed a breach after a threat actor claimed about 1 TB of its data, calling it a "potential business email compromise" and, like SBI, saying it did not expect a material impact.
What customers can do
Exposed contact details are what fraudsters use to sound convincing. If you bank with SBI, do not share your OTP, PIN or password with anyone, whoever they say they are. Treat calls and messages about your account, loan application or KYC with suspicion, and check them through the bank's official channels. Anyone who has lost money to online fraud can report it on the national cybercrime helpline, 1930, or at cybercrime.gov.in. Questions sent to the bank, CERT-In and the RBI about the remaining records and customer notification were still awaiting answers on Wednesday.
A
4 min
What did you think?
