Key Highlights

  • Breach confirmed: SBI said 3,897 customer records with personal information were found exposed on the dark web.
  • Larger dump checked: These were identified during a preliminary review of about 3,75,000 records available online.
  • What leaked: Names, mobile numbers, dates of birth, email and home addresses, branch and CIF identifiers, and loan/lead details.
  • Probe on: SBI has activated its cyber response protocols and hired an independent CERT-In-empanelled agency to investigate.
  • No operational impact: The bank says core operations, finances and services are running normally.

State Bank of India (SBI), the country’s largest lender, has confirmed that personal data of some of its customers has been exposed on the dark web. In an exchange filing on Wednesday, the bank said 3,897 customer records containing Personally Identifiable Information (PII) were identified during a preliminary analysis of around 3,75,000 records found online.

How the Bank Found Out

SBI said it was alerted earlier this week through communications from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In, India’s national cybersecurity agency, about the suspected exposure of customer data.

What Information Was Exposed

According to the bank, the exposed details reportedly include:

  • Names and gender
  • Registered mobile numbers
  • Dates of birth
  • Email and residential addresses
  • Branch and CIF (Customer Information File) identifiers
  • Lead IDs and metadata linked to loan and lead records, along with related files

The bank has not said that passwords, PINs or card details were part of the leak.

The Hacker Group Behind the Claim

Earlier in the week, a hacker group calling itself ‘Siriusim’ claimed it had obtained confidential customer data linked to SBI, including personal details, loan applications and account-opening documents. The claim was flagged by cybersecurity monitoring account CyberPulse56 on X, which said the group allegedly holds 3.75 lakh data entries in CSV format and 2,722 PDF documents.

What SBI Is Doing

SBI said it promptly activated its cyber incident response and containment protocols. It has engaged an independent CERT-In-empanelled cybersecurity agency to assess the incident. The investigation aims to verify whether the leaked data is authentic and complete, find its source and extent, and assess the risks involved.

The bank said the incident has no material impact on its core operations, financial performance or business continuity, and that remedial and preventive steps are being put in place.

Why It Matters for Customers

Even without passwords or card numbers, leaked personal details are valuable to fraudsters. With a name, phone number, address and loan details, scammers can pose convincingly as bank officials and trick people into sharing OTPs or clicking harmful links.

How to Stay Safe

  • Never share OTPs, PINs or passwords with anyone, even if the caller claims to be from SBI.
  • Be cautious of calls or messages about loans that mention your personal details.
  • Do not click unknown links sent via SMS, email or WhatsApp.
  • Check account activity regularly and enable transaction alerts.
  • Report fraud immediately to the bank and the national cybercrime helpline 1930 or cybercrime.gov.in.

Market Reaction

SBI shares traded flat at Rs 970 around 10 am on the BSE on Wednesday. The stock’s 52-week high is Rs 1,234.80 and its low is Rs 891.55. It has fallen 12 per cent over the past year.

What Comes Next

Customers will be watching for the findings of the independent investigation and whether SBI directly informs affected account holders.

With inputs from IANS.