State Bank of India Discloses Data Breach Involving Customer Information on Dark Web

The State Bank of India informed stock exchanges about a security incident involving customer data exposure, five days after receiving alerts from the Defence Cyber Agency, CERT-In, and its Threat Intelligence Service Provider. SBI stated that a preliminary analysis of roughly 375,000 dark web records identified 3,897 customer entries containing Personally Identifiable Information.

Details and Risks

The claim originated from an actor known as Siriusim, according to Kaspersky security researcher Saurabh Sharma, who noted that the alleged dataset includes customer names, addresses, loan applications, account-opening forms, and KYC documents. The Internet Freedom Foundation urged SBI to directly notify every affected customer without delay and called on the Reserve Bank of India to direct all regulated entities to notify customers of personal data breaches within a fixed period under current rules. The Foundation also asked the Ministry of Electronics and Information Technology to immediately bring Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules into force.

Customer Guidance

Experts advise customers to assume their data is active and to immediately change net banking and YONO passwords, enable two-factor authentication, and check accounts for unknown devices or IP addresses. Customers should report any unauthorized transactions promptly, as reporting within three working days limits financial liability under RBI norms, and complaints can be filed via cybercrime.gov.in or by calling 1930.

Context

Financial institutions face growing digital threats from credential theft and third-party vendor vulnerabilities, making continuous dark web monitoring and strict vendor audits essential security practices. Consumer caution remains critical when dealing with unexpected calls or messages concerning loans and account updates.