India's Largest Bank Confirms Leak: 3,897 Customer Records Surface on Dark Web

State Bank of India, the country's largest and state-owned lender, has confirmed a data leak. In a stock-exchange filing dated October 21, the bank reported an "incident involving the loss of certain data," guardedly calling it an "alleged compromise."

Among roughly 375,000 records offered on the dark web, the bank identified 3,897 containing its customers' personal information — about one in a hundred of those it examined. The count is preliminary: the bank has yet to establish whether the data is authentic, how far the exposure reaches, or what risk it poses to customers.

What was exposed

In the filing's words, the information "reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records." A CIF is the bank's internal customer information file number.

What the list omits matters too: no account numbers, balances, passwords, one-time passcodes, card details, or government identifiers such as PAN or Aadhaar. The risk in the listed categories is impersonation — a call or message wielding a customer's name, number, date of birth, address, and internal ID looks convincingly like the bank.

How it came to light

The alert reached the bank on October 16, via its threat intelligence provider, the national response team CERT-In, and the Ministry of Defence's cyber agency. The bank activated its response procedures and engaged an independent firm from CERT-In's panel of auditors. The incident has no material impact on the bank's operations, financial performance, or business continuity, the filing says — but that covers the bank, not its customers.

The filing names no attacker, forum, or dataset. Yet the figure of about 375,000 matches a post by the monitoring account CyberPulse56 on X on October 16: an actor calling itself Siriusim claimed to have leaked 375,000 CSV rows and 2,722 PDF documents tied to SBI — loan applications, account-opening forms, addresses.

The Free Press Journal examined the BreachForums listing and found four sample records. The phone numbers were valid; a WhatsApp profile picture on one matched the passport photo in that person's KYC document, which the actor had also posted. But checking four records proves neither the authenticity of the whole set nor whether the data belongs to SBI itself, a subsidiary, or a third-party processor.

Whether the 2,722 PDFs were part of what the bank examined is unconfirmed. Whether any SBI system was breached remains open; the bank left the source and first-appearance date to the investigation. Tellingly, in July another state lender, Bank of Baroda, filed almost identical language — including "alleged compromise" — but at least named a preliminary cause.

Source: The Hacker News