SBI cyberattack: Personal data of 3897 customers leaked on dark web, probe ordered

State Bank of India (SBI), the country's largest lender, on Wednesday, October 21 disclosed that a cyberattack on its systems had exposed the personal and loan-related information of 3,897 customers on the dark web. The bank has engaged an independent cybersecurity agency to investigate the breach and determine its extent.

An initial assessment by SBI found that the compromised information included customers' names, mobile numbers, dates of birth, email addresses, residential addresses, customer identifiers and loan records.

The bank said the incident was not expected to have a material impact on its core operations, financial performance or business continuity. However, the exposure of personal and financial information raises concerns about the potential misuse of the data for identity theft, financial fraud and targeted cyberattacks.

According to CyberPulse, an account on X that tracks cybersecurity incidents, a group identifying itself as Siriusim claimed responsibility for the breach. The account said the leaked data first appeared online on October 16, five days before SBI publicly disclosed the incident.

The cybersecurity intelligence account reported that the leaked material comprised around 375,000 rows of comma-separated values (CSV) data and 2,722 PDF documents. The files allegedly included loan applications, supporting documents, account-opening forms and other application-related information.

The full extent of the exposure and the authenticity of the material are yet to be independently established.

CyberPulse warned that the leaked information could be exploited for identity theft, financial fraud, targeted phishing campaigns and the submission of fraudulent loan applications. Personal details combined with loan and address records could also enable criminals to craft convincing messages or impersonate bank officials to deceive customers.

The breach comes amid growing concerns over cybersecurity risks in India's banking sector, with financial institutions facing increasing threats from organised cybercriminal groups. The incident also underscores the risks associated with the exposure of customer information held by large financial institutions.
What SBI customers should do
Customers have been advised to remain alert to unsolicited calls, messages and emails claiming to be from the bank, particularly those involving loans, Know Your Customer (KYC) updates or account-related issues.

They should not share one-time passwords (OTPs), PINs, passwords or card verification values (CVVs) with anyone. Customers should also avoid clicking on suspicious links or opening unexpected attachments and independently verify requests for sensitive information through SBI's official channels.

Any suspicious account activity or suspected attempt at fraud should be reported to the bank promptly.

SBI's investigation is expected to establish how the breach occurred, the extent of the data exposure and the potential risks to affected customers.