State Bank of India confirms cyberattack, data of 3,900 customers exposed on dark web – all you need to know
State Bank of India on Wednesday reported a cyberattack that resulted in the disclosure of 3,897 customer records containing personally identifiable information on the dark web.
SBI said a preliminary analysis showed that the exposed information included customer names, mobile numbers, dates of birth, email addresses, residential addresses, brand and customer identifiers, along with loan records.
What SBI said
SBI, in a regulatory filing said it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of the Bank’s customer data on the dark web.
According to SBI, the exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files.
“A detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank.
The Bank promptly activated its cyber incident response and containment protocols. Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise,” it added.
The leak is not expected to have any material impact on the bank’s core business operations, financial performance or business continuity, SBI said.
SBI added that it was closely monitoring the situation and taking all appropriate measures in accordance with applicable regulatory requirements.
Who is behind the cyberattack?
According to CyberPulse, an X account tracking cybersecurity intelligence breaches, the cyberattack was carried out by a group identified as Siriusim and was first reported on October 16.
Personal customer information
Loan applications and supporting documents
Account-opening applications
Address and other application-related details
CyberPulse warned that the data could facilitate identity theft, financial fraud, targeted phishing and fraudulent loan applications.
What customers should do?
Prashant Mali, a Mumbai-based lawyer and Cyber, AI, and data protection expert, warned that cybercriminals could use the stolen data to target unsuspecting customers.
To remain safe from cybercrimes, Mali urged SBI customers to:
Don’t click on any links or disclose your OTP, PIN, password, or CVV
Verify unexpected calls about loans, KYC, or account problems independently.
Avoid clicking suspicious links or opening unexpected attachments.
Report suspicious activity directly through SBI’s official channels.
