The State Bank of India (SBI) has moved to reassure its customer base following the disclosure of a recent cyber incident that resulted in the exposure of personal information. In an official statement released on Friday, the bank emphasized that despite the breach, all individual account balances and financial funds remain secure.
This communication follows a preliminary internal analysis conducted by the bank, which identified 3,897 customer records among a larger dataset of approximately 3.75 lakh records discovered on the dark web. The bank reported that it has proactively contacted every customer whose personal data was identified in the compromised records, utilizing both email and WhatsApp to deliver notifications regarding the incident.
The breach first came to the bank's attention on October 16, following alerts from its internal threat intelligence service provider, as well as notifications from the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). Upon receiving these alerts, the institution activated its cyber incident response protocols and engaged an independent cybersecurity agency to facilitate a comprehensive investigation.
Reports indicate that the data circulating on the dark web—attributed to a threat actor operating under the name 'Siriusim'—contained a variety of sensitive information. The exposed details reportedly include customer names, dates of birth, registered mobile numbers, email addresses, residential addresses, and gender. Furthermore, the dataset contained branch information, Customer Information File (CIF) identifiers, lead IDs, and various metadata associated with loan and lead records.
According to claims made by the cybersecurity monitoring account CyberPulse, the leaked material allegedly spanned 3.75 lakh rows of CSV files and included 2,722 PDF documents. These documents purportedly contained loan applications, account-opening forms, and supporting personal documentation. The bank has noted that a detailed investigation is currently underway to verify the authenticity and completeness of these records, as well as to determine the specific source and scope of the exposure.
The bank stressed that the incident has not had any material impact on its core business operations or financial performance. According to the institution, its essential functions have continued to operate normally throughout the period following the detection of the breach. The bank is currently working with an agency empanelled by CERT-In to conduct an independent assessment of the situation.
As the investigation progresses, the bank is in the process of implementing various remedial and preventive measures aimed at fortifying its digital security infrastructure. These efforts are intended to mitigate potential risks to both the bank's operational integrity and its customers. The institution has maintained its focus on transparency, ensuring that affected individuals are kept informed as the forensic analysis continues to unfold.
While the bank has not provided a timeline for the conclusion of the probe, the focus remains on assessing the extent of the impact and ensuring that customer interests are protected. The involvement of specialized national agencies underscores the gravity with which the situation is being handled, as the bank seeks to contain the fallout from the unauthorized access to its records.
Comments