SBI Investigates Potential Exposure of 3,897 Customer Records Found in Dark-Web Dataset
Summary
SBI says it identified 3,897 customer records in a dark-web dataset of about 375,000, but authenticity and origin are unknown. The bank is investigating; sample checks supported some records but did not verify the full dataset.
Key points
- SBI reported a preliminary count of 3,897 customer records among about 375,000 records found on the dark web; it has not established the data's source or authenticity.
- The reported data includes personal and contact details, internal customer identifiers, and loan-related metadata. The filing does not list account numbers, balances, passwords, or card details.
- SBI said it was alerted on October 16 by CERT-In, its threat intelligence provider, and the Defense Cyber Agency, and has activated incident response and containment procedures.
- A cybersecurity firm approved by CERT-In is assessing the alleged compromise. SBI has not said whether any of its systems were breached or whether customers will be notified.
- The Free Press Journal checked four sample records from a BreachForums listing; phone numbers were valid, and one person's WhatsApp profile photo matched a photo in a posted KYC document. This does not establish that the full dataset is genuine or identify its source.
- A CyberPulse56 post attributed the 375,000-record claim to a threat actor using the name Siriusim; SBI's filing does not name an attacker or link its analysis to that listing.
Article Details
- Victim Organization
- State Bank of India
- Incident Type
- Reported exposure of customer data; the source and whether an SBI system was breached remain undetermined.
- Disclosure Date
- 2026-10-21
- Data Types Exposed
- Names
- Gender
- Registered mobile numbers
- Dates of birth
- Email addresses
- Residential addresses
- Branch identifiers
- Customer information file (CIF) identifiers
- Lead IDs
- Metadata associated with loan and lead records
- KYC fields and documents in four samples examined by the Free Press Journal
- Affected Records
- The bank identified 3,897 records with personal information in a set of about 375,000 records it examined. It has not established whether the data is authentic or whether the records correspond to distinct individuals. The Free Press Journal examined four sample records associated with the listing.
- Affected Data Size
- A threat actor reportedly claimed the dataset contained 375,000 CSV rows and 2,722 PDF documents; the bank has not said whether those PDFs were included in its review.
- Operational Impact
- The bank reported no material impact to core business operations, financial performance, or business continuity. Customer risk from the listed data includes impersonation. The bank activated incident response and containment procedures and engaged an independent cybersecurity firm to assess the alleged compromise.
- Ransom Or Extortion
- No ransom or extortion activity was reported.
- Claim Status
- alleged