SBI Finds 3,897 Customer Records on Dark Web After Hacker’s Claim
Bank launches detailed cybersecurity probe; says core operations not expected to be affected
State Bank of India (SBI) has disclosed a suspected customer data breach after finding personal information on the dark web. The country’s largest public sector lender confirmed in a stock exchange filing on Wednesday that it found 3,897 records containing personal information, and it has launched a detailed cybersecurity investigation.
How the Bank Found the Data
SBI said it received alerts from its threat intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In), all pointing to a possible exposure of customer information. During a preliminary examination of about 3.75 lakh records found on the dark web, the bank identified 3,897 entries containing customer information.
The Hacker’s Claim
Before the bank’s disclosure, an unidentified hacker group calling itself “Siriusim” claimed to have obtained confidential customer information linked to SBI. The claim was highlighted by the cybersecurity monitoring account CyberPulse56 on X. According to reports, the group said on the dark web forum BreachForums that it had data on roughly 3.75 lakh SBI customers. That claim has not been independently verified. The poster also shared four sample records as evidence.
What Data Was Exposed
A preliminary analysis showed that the exposed information included customer names, mobile numbers, dates of birth, email addresses, residential addresses, brand and customer identifiers, and loan records.
SBI has not yet said how many of the 3,897 records could be linked to current customers.
Bank’s Response
SBI said it has engaged an independent cybersecurity agency to carry out a comprehensive assessment and examine the nature and extent of the leak. The lender also said the incident is not expected to have any material impact on its core business operations, financial performance, or business continuity.
What Customers Can Do
The full scale of the incident is still unclear, so customers should stay alert. Cybersecurity practices generally advise people to:
- Be cautious of calls, SMS, or emails that mention loan or account details, since leaked personal data is often used for phishing and impersonation.
- Never share OTPs, PINs, or passwords with anyone claiming to be from the bank.
- Check account statements regularly and report suspicious transactions to the bank immediately.
- Use only official SBI channels for any account-related queries.
SBI is expected to share more details as its investigation progresses.
Add Business Connect magazine to your Google News feed