The State Bank of India (SBI), the country's largest lender, on Wednesday confirmed that 3,897 customer records containing personally identifiable information (PII) were found exposed on the dark web, following alerts from cybersecurity agencies and its threat intelligence service provider.
In an exchange filing, the public sector lender said it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure of customer data earlier this week.
During a preliminary analysis of approximately 3.75 lakh records available on the dark web, 3,897 customer records containing personally identifiable information were identified, the bank said.
The exposed information reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch details, Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan and lead records, along with other related files.
SBI said it promptly activated its cyber incident response and containment protocols following the alerts. It also engaged an independent cybersecurity agency empanelled with CERT-In to conduct a comprehensive assessment and investigate the nature and extent of the suspected compromise.
The bank added that a detailed investigation is underway to verify the authenticity and completeness of the exposed data, identify the potential source and extent of the exposure, and assess the associated risks.
SBI clarified that the incident has had no material impact on its core business operations, financial performance or business continuity. Its core functions continue to operate normally without disruption, and appropriate remedial and preventive measures are being implemented.
Hacker group claims responsibility
Earlier this week, an unidentified hacker group operating under the name 'Siriusim' claimed to have obtained confidential customer information allegedly linked to SBI. The purported data included personal details, loan applications and account-opening documents.
The claim was highlighted by cybersecurity monitoring account CyberPulse56 in a post on social media platform X.
According to the post, the group allegedly possesses around 3.75 lakh data entries in CSV format and 2,722 PDF documents associated with the country's largest public sector lender. SBI's preliminary analysis subsequently identified 3,897 records containing personally identifiable information among the data available on the dark web.
The bank's ongoing investigation is expected to establish the authenticity of the exposed records and determine the extent of the potential compromise.
SBI shares trade flat
Meanwhile, SBI shares traded on a flat note at around Rs 970 on the BSE at approximately 10 am on Wednesday.
According to exchange data, the stock recorded a 52-week high of Rs 1,234.80 and a 52-week low of Rs 891.55. The banking stock declined around 12 per cent over the past year but recorded gains over a five-year period.
