India's largest public sector lender, State Bank of India (SBI), has confirmed a cybersecurity incident involving the exposure of sensitive customer information on the dark web, raising concerns over data security and the possibility of financial fraud.
The bank has identified 3,897 affected customer records and launched an independent investigation to determine the source and extent of the breach.
The incident, disclosed on Wednesday, October 21, comes amid growing concerns over cyberattacks targeting India's banking and financial services sector.
According to SBI's preliminary assessment, the compromised records contain personally identifiable information, including customer names, mobile numbers, dates of birth, email addresses and residential addresses.
The exposed information also includes customer identifiers, brand-related details and loan records. Such information could potentially be exploited by cybercriminals for identity theft, phishing attacks and other fraudulent activities.
However, the bank has not indicated that customers' account balances or funds have been compromised.
SBI has appointed an independent cybersecurity agency to undertake a comprehensive investigation into the incident. The assessment will examine the nature of the breach, the extent of the information exposed and the circumstances surrounding the leak.
The bank said the incident was not expected to have any material impact on its core business operations, financial performance or business continuity.
The incident follows allegations circulated by cybersecurity monitoring account CyberPulse on social media platform X.
According to the account, a hacker group identified as Siriusim claimed responsibility for accessing data allegedly linked to SBI. The claims first surfaced on October 16. The group allegedly obtained a substantially larger collection of records than the number SBI has so far identified.
The claimed dataset includes:
Approximately 3.75 lakh CSV data entries
2,722 PDF documents
Personal customer information
Loan applications and supporting documents
Account-opening applications
Residential addresses and other application-related details
However, these figures remain claims by the alleged attackers and have not been independently verified. SBI's confirmed disclosure concerns 3,897 customer records. The larger dataset should not be treated as evidence that an equivalent number of individual customers were affected.
The disclosure of personal information could expose affected customers to targeted cyber fraud.
Fraudsters possessing names, telephone numbers, addresses and loan-related information may be able to make fraudulent calls or messages appear more convincing.
Customers could receive communications falsely claiming to originate from SBI, particularly concerning loan approvals, pending repayments, account verification or Know Your Customer (KYC) updates.
Cybersecurity experts have warned that leaked personal information could also be misused for identity theft, fraudulent loan applications and phishing attempts.
Customers have been advised to remain vigilant, particularly when receiving unexpected banking-related communications.
They should never share one-time passwords (OTPs), ATM PINs, internet banking passwords or card verification values (CVVs) with callers or through unfamiliar websites.
Unexpected calls concerning loan applications, KYC verification or account restrictions should be independently verified through SBI's official customer service channels.
Customers should also avoid clicking suspicious links, downloading unsolicited attachments or installing applications recommended by unknown callers.
Regularly reviewing account statements and transaction alerts can help customers identify unauthorised activity. Any suspicious transactions should be reported immediately to the bank.
The incident comes at a time when the Reserve Bank of India has been pushing banks to strengthen their cybersecurity infrastructure, risk management systems and customer data protection mechanisms.
Increasing digital banking adoption has expanded the potential targets for cybercriminals, making the protection of personal and financial information an important priority for financial institutions.
For SBI, the immediate challenge is to establish the full extent of the breach, identify any vulnerabilities and prevent further exposure of customer information.
Although the bank does not expect a material disruption to its operations, the incident highlights the risks associated with handling large volumes of sensitive customer data.
