SBI Reports Suspected Data Exposure of 3,897 Customers on Dark Web
Bank launches detailed investigation after alerts from cyber agencies; exposed information may include names, mobile numbers, email IDs, residential addresses and loan-related records
According to the bank’s regulatory filing, the incident came to light after SBI received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) concerning the suspected exposure of customer data on the dark web.
During the preliminary analysis of approximately 375,000 records available on the dark web, investigators identified 3,897 customer records containing personally identifiable information (PII). The bank has initiated a detailed investigation to establish the authenticity and completeness of the data, determine the possible source and extent of the exposure, and assess the risks to customers and the bank.
What Customer Information May Have Been Exposed?
The preliminary findings indicate that the records may contain a range of personal and banking-related information. The potentially exposed details reportedly include customers’ registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses.
The data also reportedly contains branch and Customer Information File (CIF) identifiers, lead identification numbers, and metadata associated with loan and lead records, along with other related files.
The exposure of such information could raise concerns about customers’ privacy and the potential misuse of personal details. If the information is authentic, it could potentially be exploited for targeted phishing attempts, fraudulent calls, identity-related scams or other social engineering attacks.
However, the bank’s filing does not establish that the information has been misused or that unauthorised transactions have occurred. The precise origin of the data, the circumstances surrounding its appearance on the dark web and the extent of any actual compromise remain under investigation.
SBI Activates Cybersecurity Response Measures
SBI stated that it promptly activated its cyber incident response and containment protocols after receiving the alerts. The bank has also engaged an independent cybersecurity agency empanelled with CERT-In to conduct a comprehensive assessment of the incident.
The investigation is intended to determine the nature and extent of the alleged compromise, verify the data identified during the initial examination and evaluate the associated risks. The findings will help the bank determine what further remedial and preventive measures may be necessary.
The involvement of an independent cybersecurity agency is expected to support a more detailed technical assessment of the suspected exposure. However, the bank has not yet disclosed the final findings of the investigation or identified a confirmed source of the incident.
Bank Says Core Operations Remain Unaffected
In its regulatory disclosure, SBI emphasised that the incident has not had any material impact on its core business operations, financial performance or business continuity.
The bank stated that its core functions continue to operate normally without disruption. It also assured stakeholders that it is monitoring the situation closely and taking appropriate measures in accordance with applicable regulatory requirements.
The disclosure does not indicate any disruption to banking services arising from the incident. Nevertheless, the investigation remains important for establishing whether the exposed records originated from SBI’s systems or another source and whether additional customer information may have been affected.
What Customers Should Watch Out For
While the investigation continues, customers should remain alert to suspicious calls, messages and emails claiming to be from SBI or other financial institutions. They should avoid sharing OTPs, PINs, passwords or banking credentials with anyone and should not click on unverified links claiming to offer account verification or security updates.
Customers should also be cautious of callers who use personal details to make fraudulent communications appear genuine.
SBI’s October 21 filing confirms the identification of potentially sensitive customer records during a preliminary analysis, but the full scope and source of the suspected exposure have yet to be established.
The bank’s ongoing investigation will be crucial in determining the authenticity of the records, the potential risks to affected customers and whether further protective action is required.
