Internet Freedom Foundation urges SBI to directly notify customers affected by dark web data breach

UPDATE - follow-up to SBI probes dark web exposure of nearly 3,900 customer records: State Bank of India did not detect the dark web data breach itself and learned of it from outside agencies after the information was already published online.

Details and Demands

The Internet Freedom Foundation stated that a threat monitoring account on X flagged a claim by a group named Siriusim regarding the release of 3.75 lakh rows of SBI data and 2,722 PDF documents. SBI identified 3,897 customer records containing personally identifiable information out of roughly 3.75 lakh records available on the dark web. The exposed details include mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, and loan lead metadata.

Context

The Internet Freedom Foundation has called on SBI to directly inform every affected customer by SMS, email, and letter without delay, while noting that current reporting obligations under CERT-In and RBI frameworks require disclosures to regulators rather than individual customers.