SBI Confirms Cyberattack After 3,897 Customer Records Surface on Dark Web
India’s largest bank found the records — names, phone numbers, birth dates, and loan details — after a threat actor’s claim pointed it to the dark web.
The State Bank of India has confirmed a cyberattack on its customer data. The country’s largest lender said it found 3,897 records containing customers’ personal information on the dark web.
SBI disclosed the breach in a stock exchange filing on Wednesday. It said it received alerts on October 16 from three sources: its own threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team.
The bank examined roughly 375,000 records circulating on the dark web. Within them, it identified 3,897 entries with personally identifiable information. The records included names, mobile numbers, dates of birth, email addresses, and home addresses, along with branch details, customer file identifiers, and loan records.
The disclosure follows a claim by a threat actor calling itself “Siriusim.” The actor posted on BreachForums, a site known for trading stolen data, claiming to hold some 375,000 SBI-linked records plus 2,722 PDF documents. The claim was first flagged on X on October 16 by the cybersecurity monitoring account CyberPulse56. SBI’s own findings do not establish that all 375,000 records belong to customers, and the hacker’s claim has not been independently verified.
SBI said it has activated its cyber incident response protocols and hired an independent cybersecurity agency empaneled with CERT-In to investigate. The agency will verify the leaked records, trace how the data got out, and assess the risk to customers.
The bank said the incident will not materially affect its core operations, financial performance, or business continuity.
India’s banking regulator has been pressing lenders to harden their cybersecurity in recent years, as attacks on financial institutions have grown more frequent.
