State Bank of India Confirms Cyber Breach with Customer Records Stolen

What Happened

The State Bank of India has confirmed a cyberattack that resulted in the theft of customer records and their subsequent leak on the dark web. In a filing with stock exchanges, the bank stated that 3,897 customer records containing personally identifiable information were exposed. The stolen data includes customers' registered mobile numbers, dates of birth, names, gender, email addresses, and home addresses. Additional exposed files contained branch information, customer file identifiers, lead IDs, and metadata linked to loan records.

Investigation and Response

The bank received alerts about the breach on October 16 from the Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team, known as CERT-In. A preliminary check of roughly 3,75,000 records found on the dark web helped identify the specific 3,897 customer records. SBI stated that its core banking operations remain safe and functional, with business continuity unaffected. The bank quickly started its cyber incident response rules and is running a detailed check to find the source of the leak, verify the data, and assess risks. An anonymous hacker group called Siriusim had earlier claimed on a dark web forum to hold information on 3.75 lakh SBI customers, though the bank did not name this group in its filing.

Context

This incident follows a similar data leak in July where the Bank of Baroda exposed one terabyte of customer data. Such breaches highlight growing cyber security challenges faced by major financial institutions in India. Banks continue to work with cyber agencies like CERT-In to protect sensitive customer details from malicious online groups.