The State Bank of India (SBI) disclosed that a suspected cyber incident involving 3,897 customer records containing personally identifiable information, found among roughly 3.75 lakh records circulating on the dark web. The bank has not named the group behind it. An anonymous outfit calling itself Siriusim, however, claimed days earlier to have the data.
Who is Siriusim?
Very little is publicly known about the hacker group. Reports describe it as an unidentified hacker group operating under that name. It made its claims on BreachForums, a dark web forum. BreachForums is a cybercrime forum known for trading stolen data.
What the group claims
Siriusim says it holds over 3.75 lakh rows in CSV format and 2,722 PDF files. The material allegedly includes personal details, residential addresses, loan applications and account-opening documents. Cybersecurity monitoring account CyberPulse56 first flagged the claim on October 16, saying the group had presented the material as the first disclosure of the dataset.
The group has shared what it described as four sample customer records. The material is said to include Know Your Customer (KYC) records, Aadhaar numbers and residential addresses.
What has been verified?
An investigation into the publicly available samples found that the phone numbers in the records were valid. There is no confirmation of how the data was obtained, whether the records are recent, or whether they come from an earlier incident.
SBI's disclosure confirms that records are in circulation, but not that Siriusim is responsible. The bank said it received alerts about the suspected exposure on October 16 from its threat intelligence provider, the Defence Cyber Agency and CERT-In. It has appointed an independent cybersecurity agency empanelled by CERT-In to investigate. SBI said further investigation is needed to establish the authenticity and completeness of the data, and that the incident has had no material impact on its core operations, financial performance or business continuity. The bank has not publicly attributed the exposure to Siriusim.
What it means for customers
The exposed fields reportedly include names, registered mobile numbers, dates of birth, email addresses and residential addresses, along with branch and loan-lead metadata. This could enable convincing phishing or impersonation calls, but it does not by itself show that balances, passwords or transactions were accessed. Customers are advised not to share OTPs, PINs or passwords, and to report suspected fraud on the national cybercrime helpline 1930 or at cybercrime.gov.in.
