SBI flags suspected dark web exposure of 3,897 customer records

State Bank of India has disclosed a cyber incident involving the suspected exposure of 3,897 customer records containing personal information on the dark web. In a stock-exchange filing reported by India Today on October 21, the bank said the incident had not materially affected its core operations, financial performance or business continuity.

SBI said it received an alert on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, or CERT-In. A preliminary examination of about 3.75 lakh records found on the dark web identified the 3,897 customer records.

What information was identified

The information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. The filing also listed branch identifiers, customer information file identifiers, lead IDs and metadata associated with loan records, lead records and related files.

The bank cautioned that a detailed investigation was needed to establish the authenticity and completeness of the data, trace its potential source, determine how extensive the exposure was and assess risks to customers and the bank. The preliminary identification therefore does not settle the full scope of the incident.

Bank says core services remain operational

SBI said its main banking functions were running without interruption and that it had activated its cyber-incident response and containment procedures promptly. It said it would continue monitoring the situation and take measures consistent with applicable regulatory requirements.

The bank’s statement about operational continuity is separate from its assessment of customer-data exposure: uninterrupted banking services do not resolve the questions the investigation is examining.

Larger hacker claim remains unconfirmed

Earlier reporting on October 19 described a claim by an anonymous hacker group using the name Siriusim on BreachForums. The group alleged that it had obtained information relating to 3.75 lakh SBI customers.

That allegation is not equivalent to SBI confirming that 3.75 lakh customers were affected. The bank described a preliminary review of roughly that many records, identifying 3,897 customer records containing personal information. SBI did not name the group responsible, and the identity of the actor behind the incident remains unconfirmed.