SBI Confirms Data Breach: 3,897 Customer Records Found Exposed on Dark Web

The State Bank of India (SBI) has confirmed that 3,897 customer records containing personally identifiable information were found exposed on the dark web, prompting the public sector lender to launch a detailed cybersecurity investigation.

In a filing on Wednesday, October 21, SBI said it had received alerts earlier in the week from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure of customer data.

Names, Mobile Numbers and Addresses Among Exposed Details

SBI said its preliminary analysis covered approximately 3.75 lakh records available on the dark web. Of these, 3,897 records were identified as containing personally identifiable information (PII).

The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. Branch details, Customer Information File (CIF) identifiers, lead IDs, metadata linked to loan and lead records, and other related files were also among the information identified.

The bank said it had activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment.

SBI Launches Investigation, Says Operations Unaffected

SBI said the investigation was underway to establish the authenticity and completeness of the exposed data, identify the possible source and extent of the exposure, and assess the associated risks.

The lender added that the incident had no material impact on its core business operations, financial performance or business continuity. Its core functions continued to operate normally without disruption, it said.

The bank is implementing remedial and preventive measures as part of its response to the incident.

Hacker Group Allegedly Claims Access to SBI Data

Earlier in the week, a hacker group operating under the name ‘Siriusim’ allegedly claimed to have obtained confidential customer information linked to SBI. The claimed data reportedly included personal details, loan applications and account-opening documents.

Cybersecurity monitoring account CyberPulse56 highlighted the claim in a post on social media platform X.

According to the post, the group purportedly possessed around 3.75 lakh data entries in CSV format and 2,722 PDF documents associated with India’s largest public sector lender. SBI’s preliminary review subsequently identified 3,897 records containing personally identifiable information among the material available on the dark web.

The bank’s investigation is expected to establish the authenticity and scope of the exposed information.

SBI Shares Trade Flat

SBI shares traded largely flat at around ₹970 on the BSE at approximately 10 am on Wednesday.

According to exchange data, the stock has a 52-week high of ₹1,234.80 and a 52-week low of ₹891.55. It has declined around 12% over the past year, although it has recorded gains over a five-year period