State Bank of India (SBI) has identified 3,897 customer records containing personal information among approximately 375,000 records circulating on the dark web.
The bank disclosed the suspected SBI data breach to stock exchanges on October 21, following alerts received on October 16. Its initial review flagged customer information, while an independent cybersecurity agency investigates the source, authenticity and potential impact.
The exposed details reportedly include names, mobile numbers, email addresses, dates of birth and residential addresses. Other information includes gender, branch details, customer information file identifiers, lead IDs and metadata linked to loan applications. SBI has not established whether every record is authentic or determined how the information reached the dark web.
SBI said it activated its cyber incident response and containment procedures after receiving alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In. The bank has also engaged an independent cybersecurity agency to assess the incident and recommend preventive measures.
In its stock exchange disclosure, SBI said, “A detailed investigation was required to establish the authenticity and completeness of the exposed data.” The investigation will also determine the potential source, extent and risks associated with the exposure.
The bank stated that the incident has not materially affected its core operations, financial performance or business continuity. Banking services continue to operate normally, according to its disclosure.
An anonymous group called Siriusim previously claimed it obtained data linked to around 375,000 SBI customers. Reports connected the claim to the BreachForums platform, although SBI has not attributed the incident to that group.
The exposed information could help scammers create convincing phishing messages, impersonation calls and fraudulent loan-related approaches. Customers should avoid sharing one-time passwords, UPI PINs, card security codes or banking credentials with anyone claiming to represent the bank.
Suspicious messages should be verified through official SBI channels rather than contact details supplied by callers. Customers who suspect financial fraud can contact India’s cybercrime helpline at 1930. The final number of affected records and the source of exposure remain under investigation.
Also Read: KB Kookmin Card, SBI Partner on AI and Stablecoin Payments