SBI Finds 3,897 Customer Records in Suspected Dark Web Data Exposure

In an exchange filing on Wednesday, the country's largest lender said it received alerts about the suspected exposure on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In. A preliminary analysis of approximately 375,000 records available on the dark web identified 3,897 records containing PII.

According to SBI, the information reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. The records also contained branch and customer information file (CIF) identifiers, lead IDs, metadata associated with loan and lead records, and other related files.

"During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files," the bank stated.

SBI said it had activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to assess the alleged compromise and the potential risks to customers and the bank.

The investigation is expected to establish whether the data is authentic and complete, identify the potential source and extent of the exposure, and evaluate the risks associated with the incident. The bank said appropriate remedial and preventive measures were being implemented as required.

Hacker Group Claims to Have 3.8 Lakh Data Entries

The bank's disclosure follows a claim by an unidentified hacker group operating under the name 'Siriusim' that it had obtained confidential customer information allegedly linked to SBI. The purported material included personal details, loan applications and account-opening documents.

Cybersecurity monitoring account CyberPulse56 highlighted the claim in a post on the social media platform X. According to the account, the group purportedly possessed around 3.8 lakh data entries in CSV format and 2,722 PDF documents associated with the lender.

The dataset reportedly contained customers' personal information, residential addresses, loan applications, supporting documents and other application-related records. CyberPulse56 first reported the claim on October 16, stating that Siriusim had presented the material as its first disclosure of the dataset.

The monitoring account warned that the information could potentially be exploited for identity theft, financial fraud, targeted phishing attacks and fraudulent loan applications. However, SBI's preliminary findings and the hacker group's claims remain subject to the ongoing investigation into the authenticity and scope of the alleged exposure.

SBI Says Core Business Operations Remain Unaffected

SBI clarified that the incident had no material impact on its core business operations, financial performance or business continuity. The lender said its core business functions continued to operate normally without disruption.

"We wish to submit that this does not have any material impact on Bank's Core business operations, financial performance or business continuity. The Bank's core business functions continue to operate normally without disruptions. A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required. We reassure that the Bank continues to monitor the situation closely and take all appropriate measures in accordance with applicable regulatory requirements," the lender wrote in its filing.

The bank said it would continue monitoring the situation and take appropriate measures in accordance with applicable regulatory requirements. The independent cybersecurity agency's assessment is underway, while remedial and preventive measures are being implemented as required.

The alleged exposure comes amid broader concerns over cybersecurity risks facing India's financial sector. Earlier this year, the Reserve Bank of India stepped up cybersecurity requirements for commercial banks.

With thousands of customer records identified during the preliminary analysis, the ongoing investigation will determine the authenticity and extent of the alleged exposure and assess the potential risks to affected customers and the bank.