SBI confirms exposure of 3,897 customer records on dark web

• SBI identified 3,897 customer records containing personal information in a larger dataset available on the dark web

• The bank has appointed an independent cybersecurity agency to investigate the source, extent and risks of the exposure

• Core banking services remain unaffected, with no material impact on operations or financial performance, SBI said

State Bank of India (SBI) has identified 3,897 customer records containing personally identifiable information on the dark web and launched an investigation into the source and extent of the exposure, the lender disclosed on Wednesday.

In a stock exchange filing, India’s largest bank said a preliminary examination of approximately 375,000 records available on the dark web had identified the customer information.

The disclosure followed alerts received earlier this week from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, or CERT-In.

According to the bank, the exposed records included names, registered mobile numbers, dates of birth, gender, email and residential addresses. They also contained branch details, customer information file identifiers, lead IDs and metadata linked to loan enquiries and related records.

SBI said it activated its cyber incident response and containment procedures after receiving the alerts. It has engaged an independent cybersecurity agency empanelled with CERT-In to assess the suspected compromise.

The investigation will examine the authenticity and completeness of the exposed information, identify its potential source and establish the scale of the exposure and associated risks.

The bank said the incident had caused no material impact on its core operations, financial performance or business continuity. Banking functions continued without disruption, and remedial and preventive measures were being implemented.

The disclosure comes after a hacker group using the name “Siriusim” claimed earlier this week to possess confidential information allegedly linked to SBI customers.

Cybersecurity monitoring account CyberPulse56 highlighted the claim in a post on X, saying the group purportedly held 375,000 entries in CSV files and 2,722 PDF documents. The material allegedly included personal information, loan applications and account-opening documents.

Those broader claims remain subject to verification. SBI’s preliminary findings identified 3,897 customer records within the larger dataset, with the investigation still under way.

SBI shares were trading largely unchanged at around Rs 970 on the BSE at approximately 10 am on Wednesday.

With IANS inputs