SBI confirms 3,897 customer records found on dark web; probe under way

State Bank of India (SBI), the country’s largest lender, has told the stock exchanges that personal details of 3,897 of its customers were found in a cache of data circulating on the dark web. The disclosure, filed on Wednesday, 21 October, follows a hacker group’s claim earlier this week that it had leaked SBI customer files.

In its filing, made under SEBI’s listing disclosure rules, the bank described the matter as an “incident involving the loss of certain data” and said the findings were preliminary. SBI said it is yet to establish whether the data is genuine, how complete it is, or where it came from.

3,897 or 3.75 lakh? Reading the two numbers

Two very different figures have been doing the rounds, and both are linked to the same episode. On 19 October, reports citing the X account CyberPulse56 said a group calling itself “Siriusim” had posted on the BreachForums site more than 3.75 lakh rows of CSV data and 2,722 PDF files allegedly belonging to SBI customers. Some headlines described this as a breach affecting 3.75 lakh customers.

SBI’s own account is narrower. According to the filing, the bank was alerted on 16 October by its threat-intelligence provider, the Defence Cyber Agency and CERT-In. Its preliminary analysis covered roughly 3.75 lakh records seen on the dark web, and of these, 3,897 customer records were found to contain personally identifiable information. In other words, 3.75 lakh is the size of the dataset examined, while 3,897 is the number SBI has so far linked to its customers’ personal data.

Even that figure may change. Analysts at The Hacker News and Cybersecurity News pointed out that a record count is not the same as a count of people, since rows can repeat, and SBI has not said whether it has examined the 2,722 PDF documents the hackers claim to hold. The bank has not commented on the Siriusim claim itself.

What was exposed, and what SBI says it is doing

As per the filing, the exposed fields include customers’ names, dates of birth, gender, registered mobile numbers, email addresses and home addresses, along with internal identifiers such as branch details, Customer Information File (CIF) numbers and lead IDs, and metadata tied to loan and lead records.

The filing does not list account numbers, balances, passwords, PINs, OTPs, card details or Aadhaar and PAN numbers, and no theft of funds has been reported. SBI said the incident has “no material impact” on its core operations, finances or business continuity.

The bank said it activated its incident-response and containment procedures and has hired an independent cybersecurity firm from CERT-In’s empanelled list to assess the extent of the loss and the risk to customers, and that remedial steps are being put in place. It has not identified how the data left its systems or whether a vendor was involved.

The Internet Freedom Foundation (IFF) has criticised the disclosure for addressing investors rather than customers. The filing does not say whether affected account holders have been or will be informed. IFF noted that the breach-notification duties under the Digital Personal Data Protection Act take effect only in May 2027, and urged SBI to notify customers directly and set up a helpline, in line with a non-binding RBI advisory issued in March this year.

How customers can protect themselves

Because names, phone numbers, birth dates and branch details are enough to make a scam call sound convincing, the main risk is impersonation. Security experts and CERT-In guidance suggest a few simple precautions:

• Treat unexpected calls, SMS or emails claiming to be from SBI with suspicion, even if the caller knows your name, branch or loan details. Call back on the number printed on your passbook or the official website.
• Never share an OTP, PIN, password or CVV. Bank staff do not ask for them.
• Do not click links or install apps sent through messages that warn of account blocking or urgent KYC updates.
• Check account statements and SMS alerts regularly and report any unknown transaction immediately.
• Report suspected fraud on the national cybercrime helpline 1930 or at cybercrime.gov.in; SBI’s cyber security page also lists report.phishing@sbi.co.in for phishing attempts.

Sources

• The Hacker News: State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
• Cybersecurity News: SBI Confirms Data Breach – 3000+ Customer Records Exposed on Dark Web
• Outlook Money: SBI Confirms Cyberattack; 3,897 Customer Records Stolen, Leaked On Dark Web
• The CSR Journal: SBI Faces Allegations of Data Breach Affecting 3.75 Lakh Customers
• Internet Freedom Foundation: SBI told investors its data breach doesn’t matter. What about the 3,897 customers it affected?