The State Bank of India (SBI), the nation's largest lender, has initiated a comprehensive investigation after identifying nearly 4,000 customer records on the dark web. The bank confirmed that its preliminary analysis uncovered 3,897 records containing personally identifiable information (PII) following an initial review of approximately 375,000 files circulating online. This development comes after the bank received specific alerts regarding a potential data exposure on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In).
According to the official filing, the exposed information included a range of sensitive details such as customers' full names, registered mobile numbers, residential addresses, email addresses, dates of birth, and gender. Additionally, the records contained technical metadata, including branch and Customer Information File (CIF) identifiers, lead IDs, and various files associated with loan applications. The bank has since activated its cyber incident response and containment protocols to address the situation.
The bank’s internal investigation is currently focused on verifying the authenticity of the leaked material, tracing the source of the exposure, and determining the full extent of the potential compromise. To ensure an impartial and thorough evaluation, SBI has engaged an independent cybersecurity agency empanelled by CERT-In. This agency is tasked with assessing the specific risks posed to both the institution and its individual customers. The bank has stated that appropriate remedial and preventive measures are being implemented in line with regulatory requirements.
The incident surfaced following claims by an unidentified hacker group known as 'Siriusim,' which alleged that it had acquired a vast collection of confidential banking documents. Cybersecurity monitoring account CyberPulse56 reported that the group claimed to possess around 3.8 lakh data entries in CSV format along with over 2,700 PDF documents. These files purportedly contain personal details, loan applications, and sensitive account-opening paperwork. Security experts have cautioned that such data, if authentic, could be exploited for malicious activities including identity theft, financial fraud, targeted phishing campaigns, and the submission of fraudulent loan applications.
Despite the nature of the allegations, SBI has moved to reassure its stakeholders and customers that the situation remains under control. In its formal exchange filing, the lender stated, "We wish to submit that this does not have any material impact on Bank’s Core business operations, financial performance or business continuity." The bank emphasized that its primary business functions continue to operate normally without any disruptions. It remains committed to monitoring the situation closely as the cybersecurity audit progresses.
This incident reflects growing concerns regarding the cybersecurity landscape within India's financial sector. As digital banking adoption has surged, regulators such as the Reserve Bank of India (RBI) have progressively tightened security mandates for commercial banks to mitigate such risks. The current situation at SBI highlights the ongoing challenges that large financial institutions face in protecting vast repositories of customer data from sophisticated digital threats.
The investigation remains ongoing, and the bank continues to update its protocols as new information comes to light. As the audit by the independent cybersecurity firm continues, the lender is expected to maintain its focus on implementing necessary safeguards to prevent further unauthorized access. For now, the bank advises that its systems remain secure, and it continues to coordinate with national cyber defense agencies to protect its digital infrastructure.
Comments