SBI Confirms 3,897 Customer Records Found On Dark Web, Says Operations Unaffected

Mumbai: The State Bank of India (SBI) on Wednesday confirmed that 3,897 customer records containing personally identifiable information were identified among approximately 3.75 lakh records available on the dark web. The confirmation comes four days after The Free Press Journal became the first to report the alleged data breach on October 17. In a regulatory disclosure submitted to BSE Limited and the National Stock Exchange of India (NSE), the bank said the incident had no material impact on its core business operations, financial performance or business continuity.

It also said a detailed investigation was underway and an independent cybersecurity agency had been engaged to determine the source and extent of the suspected data exposure.

FPJ had reported that a threat actor claimed to possess 3.75 lakh customer records and 2,722 PDF documents allegedly linked to SBI and potentially its subsidiaries.

What did SBI’s preliminary investigation find?

The bank said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure.

“During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified,” the bank stated.

The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan and lead records and other related files.

Cybersecurity agency brought in to investigate

The bank said a detailed investigation was required to establish whether the exposed data was authentic and complete, identify its possible source, determine the extent of the exposure and assess the risks to customers and the bank.

“The Bank promptly activated its cyber incident response and containment protocols,” it said.

An independent CERT-In-empanelled cybersecurity agency has also been engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise.

The bank maintained that its operations remained unaffected. “The Bank’s core business functions continue to operate normally without disruptions,” it stated.

It added that a detailed assessment was underway and appropriate remedial and preventive measures were being implemented as required. The bank also said it continued to monitor the situation closely and take measures in accordance with regulatory requirements.

What FPJ’s earlier investigation revealed

FPJ had reported that a threat actor using the name “Siriusim” claimed to have obtained 3.75 lakh customer records and 2,722 PDF documents allegedly linked to SBI and potentially its subsidiaries. The actor had published four sample customer records on BreachForums, a cybercrime forum, to support the claim.

FPJ’s examination of the publicly available samples found that the phone numbers mentioned in the records were valid. Further checks revealed that a WhatsApp profile picture associated with one of the numbers matched the passport-size photograph attached to the same individual’s KYC document.

The samples suggested that at least some of the exposed information could belong to real individuals. However, the findings did not establish the authenticity of the entire data set or reveal how the information was obtained.

Key questions remain unanswered

While the bank has now acknowledged identifying 3,897 customer records during its preliminary analysis, the source of the suspected exposure remains unclear. It has not established whether the information originated directly from SBI, its subsidiaries or third-party service providers handling banking applications.

The disclosure also does not confirm how the data was obtained or whether the records were linked to a recent incident or an earlier compromise.

The development raises concerns about the exposure of customers’ personal and financial information, particularly as the earlier samples included identification documents and loan-related details. Although SBI has said its business operations remain unaffected, the ongoing investigation will be important in establishing the authenticity, source and full extent of the exposed data.