State Bank of India Confirms Leak of 3,897 Customer Records
Summary
State Bank of India acknowledged that 3,897 customer records were leaked online; the number of affected people is unclear. A media outlet verified sample PII, while the breach's cause remains unknown.
Key points
- SBI acknowledged that 3,897 customer records were leaked online, but did not say whether that equaled 3,897 people; the bank described the affected group as very small.
- A BreachForums account named Siriusim claimed to have SBI user data, including a table with 375,000 rows and 2,722 PDF files; those figures do not establish the number of affected people.
- SBI said the leaked data included names, contact details, addresses, dates of birth, bank profile IDs, loan metadata, and other files.
- The Free Press Journal verified that sample PII belonged to real Indian citizens, including one person's mobile number and KYC documents.
- The cause of the leak is unknown. SBI said core business functions continued without disruption; the article suggests a peripheral system may have been involved but does not establish this.
- Experts warn the exposed information could enable convincing phishing or vishing, identity and loan fraud, and attempts to impersonate the bank or a recovery agent.
Article Details
- Victim Organization
- State Bank of India (SBI)
- Incident Type
- Customer data leak
- Data Types Exposed
- Names
- Genders
- Mobile numbers
- Email addresses
- Home addresses
- Dates of birth
- Bank profile IDs
- Loan metadata
- Other files
- Central KYC numbers (reported in follow-on coverage)
- Video KYC verification data (reported in follow-on coverage)
- Account and loan application documents, including employment and income details (reported in follow-on coverage)
- Affected Records
- SBI acknowledged that 3,897 customer records had been leaked; it did not say whether these represented 3,897 individual customers. The account posting the data claimed a table contained 375,000 rows and included 2,722 PDF files, but neither figure establishes the number of people affected.
- Operational Impact
- SBI said its core business functions continued to operate normally without disruption.
- Claim Status
- confirmed
People
Brian HusseySenior vice president for Cyderes' Howler Cell; discussed how data breaches can feed India's underground market for personal information and described the risks of data-broker lookup services.Sushant BhardwajIndependent security researcher who discussed the potential phishing, vishing, identity-fraud, and loan-fraud risks if the leaked data is genuine.