India
oi-Swastika Sruti
The State Bank of India (SBI) has disclosed a suspected exposure of customer data on the dark web, raising concerns about the risk of targeted cyber fraud. In a filing with stock exchanges, the country’s largest public sector bank said a preliminary analysis of around 3.75 lakh records found online had identified 3,897 customer records containing personally identifiable information (PII).
State Bank of India reported a suspected dark web exposure of 3,897 customer records with PII, following alerts on Oct 16th from CERT-In; core banking operations are normal, but investigations into the source, extent, and customer notification impact are ongoing.
The exposed information reportedly includes customers’ names, registered mobile numbers, dates of birth, email addresses, residential addresses and other details linked to bank branches and loan-related records.
SBI said it activated its cyber incident response and containment protocols after receiving alerts about the suspected exposure. The bank also stated that its core banking operations continued normally and that the incident had not materially affected its financial performance or business continuity.
How SBI Discovered The Suspected Data Exposure
As per the disclosure made by SBI, the bank was alerted on October 16 through its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) about the suspected leakage of the customers’ data.
A review of around 3,75,000 data available in the dark web by the bank revealed 3,897 customer records, including personal details of the customers.
A detailed investigation is required to confirm the authenticity of the data and its source, according to the bank.
SBI has not identified the party behind the leakage of the data in its disclosure.
What Customer Information Was Exposed?
SBI’s filing listed several categories of information found in the records identified during its preliminary analysis.
The exposed information reportedly includes:
- Customers’ names and gender
- Registered mobile numbers
- Dates of birth
- Email addresses
- Residential addresses
- Bank branch identifiers and Customer Information File (CIF) identifiers
- Lead IDs and metadata linked to loan or lead records
- Other information associated with related files
The disclosure of such information can create risks beyond the loss of privacy. Fraudsters may use personal details to make calls or send messages that appear genuine, making it harder for customers to recognise scams.
Internet Freedom Foundation Raises Questions Over Customer Alerts
The Internet Freedom Foundation has also raised questions about the internal detection of the incident by SBI and whether the customers whose details might have been compromised have been notified about it.
As per the organization, SBI came to know about the suspected compromise via external alerts after the data was reportedly available on the web. It also referred to a statement circulated on October 16 from a threat monitoring account on X, according to which the breach involved approximately 3.75 lakh rows of SBI data and 2,722 PDF documents like loan application forms and account opening forms, released by an entity named “Siriusim”.
SBI has not stated in its filing that the named entity is responsible for this leak incident.
The organization has also highlighted that SBI’s filing does not state the nature of the rest of the records apart from the 3,897 records with personal identifiers.
Also, it was not clear from the filing whether SBI had directly contacted the customers regarding the same.
Why The Exposed Data Could Increase Fraud Risks
The Internet Freedom Foundation warned that affected customers could face targeted calls from people pretending to be SBI officials.
Fraudsters may use a person’s name, phone number, date of birth or residential address to make a call sound convincing. They could claim there is a problem with the customer’s account, request an OTP or PIN, or pressure the person into transferring money.
Customers should therefore be cautious if someone contacts them claiming to represent SBI and refers to their personal or banking details.
Customers should never share OTPs, PINs, passwords or internet banking credentials over a call or message. They should independently verify suspicious requests through SBI’s official customer service channels and report suspected fraud promptly.
The exposure of personal information does not automatically mean that customers’ account balances or login credentials have been compromised. The full nature and extent of the incident remain subject to investigation.
What The Internet Freedom Foundation Wants SBI To Do
The Internet Freedom Foundation has called on SBI to contact every affected customer directly and without delay.
It has recommended that the bank notify customers through SMS, email and letters sent to their registered addresses. The notices, it said, should be available in English, Hindi and the language used by the customer’s branch, clearly explain what information was exposed and provide practical steps to reduce the risk of fraud.
The organisation has also called for a dedicated helpline and an online facility through which customers can check whether their information was affected.
These demands come amid concerns that customers may be vulnerable if they are unaware that their personal information could be circulating online. SBI’s disclosure, as described in the available information, does not confirm whether such a notification system or dedicated facility has been introduced.
Core Banking Operations Remain Normal: SBI
SBI said its core business functions continued to operate without disruption and that the incident had not materially affected the bank’s operations or financial performance.
The bank has said it is monitoring the situation and will take appropriate steps in line with applicable regulatory requirements. The ongoing investigation is expected to establish the authenticity of the exposed records, the possible source of the data and the risks arising from the incident.
