Business
oi-Prakash KL
State Bank of India said Tuesday it has identified 3,897 customer records containing personally identifiable information during a preliminary review of data suspected to have been exposed on the dark web. The lender has launched a detailed investigation into the incident, ANI reported.
In a stock exchange filing, SBI said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In about the possible exposure of customer data on the dark web.
State Bank of India identified 3,897 customer records with PII potentially exposed on the dark web after Oct 16 alerts from Defence Cyber Agency and CERT-In, launching a detailed investigation.
The preliminary analysis covered about 375,000 records available on the dark web. Of these, 3,897 customer records with PII were identified, the bank said.
The exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. It also included branch and customer information file identifiers, lead IDs, and metadata linked to loan and lead records and other related files.
SBI said a detailed investigation is needed to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the risks for customers and the bank.
Following the alert, the bank said it promptly activated its cyber incident response and containment protocols. It also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise.
The assessment is currently underway, and appropriate remedial and preventive measures are being implemented as required, SBI said.
The bank clarified that the incident has no material impact on its core business operations, financial performance or business continuity. Its core business functions continue to operate normally without disruptions, it added.
SBI said it will continue to monitor the situation closely and take appropriate measures in accordance with applicable regulatory requirements. The filing did not disclose the identities of the affected customers.
With inputs from agency
