SBI Finds 3,897 Customer Records on the Dark Web After Hacker Claim

State Bank of India has told stock exchanges that personal records belonging to 3,897 of its customers were found on the dark web, inside a far larger set of files whose origin the bank says it has not established.

In a filing dated October 21, the country's largest lender said it "has experienced an incident involving the loss of certain data." The bank said a preliminary review of roughly 375,000 records circulating on the dark web identified 3,897 that contained personally identifiable information. The count is preliminary, and the bank has not yet confirmed whether all of the data is genuine.

How the bank found out

The first warnings reached SBI on October 16, from three directions at once: its threat intelligence service provider, the Defence Cyber Agency and CERT-In, India's national computer emergency response team. Around the same time, a threat actor calling itself Siriusim claimed on the forum BreachForums to hold about 375,000 SBI customer records and 2,722 PDF documents, and posted four sample records. The Free Press Journal examined the samples and found the phone numbers were real. Most of the data appeared to relate to loans, with some entries tied to savings account applications.

What was in the records

The filing lists registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. It also lists branch and CIF identifiers, lead IDs and metadata connected to loan and lead records. A CIF is the bank's internal customer information file number. The filing does not list account numbers, balances, passwords, card details or government identity numbers such as PAN or Aadhaar among the exposed categories.

That mix still carries risk. A fraudster holding a customer's name, phone number, date of birth, branch and internal ID has most of what is needed to sound like the bank on a call.

The response

SBI said it switched on its cyber incident response and containment protocols and hired an independent cybersecurity agency from CERT-In's panel to test whether the data is authentic, trace where it came from and measure the risk. The bank said the incident has no material impact on its core operations, finances or business continuity. The Internet Freedom Foundation has called on the bank to write directly to every affected customer and spell out what was exposed. SBI shares were little changed in Wednesday trading.