United Nations, October 21: State Bank of India (SBI), the country’s largest lender, has confirmed that 3,897 customer records containing personal information appeared on the dark web, raising concerns over data security as the public sector bank investigates the source and extent of the suspected breach.
In a stock exchange filing on Wednesday, SBI said preliminary analysis of approximately 3.75 lakh records available on the dark web identified customer information that included names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses.
The exposed records also contained branch identifiers, Customer Information File (CIF) identifiers, lead IDs and metadata linked to loan applications, customer leads and related documents.
The bank said it received alerts earlier this week from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure.
Following the alerts, SBI activated its cyber incident response and containment procedures and appointed an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive assessment.
Investigators are examining the authenticity and completeness of the records, the possible source of the exposure and the risks associated with the compromised information.
SBI maintained that the incident had not materially affected its core business operations, financial performance or business continuity. It said banking functions continued without disruption while it implemented remedial and preventive measures.
The disclosure follows claims by an unidentified hacker group operating under the name Siriusim, which alleged earlier this week that it had obtained confidential SBI customer information, including personal details, loan applications and account-opening documents.
Cybersecurity monitoring account CyberPulse56 highlighted the group’s claims in a post on social media platform X.
According to the post, the group claimed possession of approximately 3.75 lakh data entries in CSV format and 2,722 PDF documents allegedly associated with SBI.
The bank’s investigation has yet to establish the full circumstances surrounding the reported exposure.
Meanwhile, SBI shares traded largely unchanged at approximately ₹970 on the Bombay Stock Exchange around 10 am on Wednesday.
Exchange data showed the stock’s 52-week trading range between ₹891.55 and ₹1,234.80. SBI shares declined approximately 12 per cent over the preceding year, although they recorded gains over five years.
The investigation remains underway as the bank assesses the exposed information and determines the measures required to address the incident.
