SBI Confirms Data Loss, 3,897 Customer Records Exposed

Among roughly 375,000 records found on the dark web, 3,897 contained customer details that could identify people, State Bank of India said Wednesday. The bank has confirmed a data-loss incident, but says its core business is still running normally. The exposed details reportedly include names, mobile numbers, birth dates, email and home addresses, and information tied to loan or customer files. ^1,2

SBI received alerts on October 16 from its cybersecurity monitoring company, the Defence Cyber Agency and CERT-In, India’s computer emergency response team. The alerts brought 3,897 records to light. SBI began its response and steps to limit the damage, then hired an independent cybersecurity agency approved by CERT-In to look into the possible breach. The bank says investigators must check whether the data is genuine and complete, find where it came from, and assess the risks.^1,2 Earlier claims by a group called Siriusim referred to 375,000 entries and 2,722 PDF files, but those claims had not been independently verified. ^5,9

That uncertainty matters because the number of records is not the number of people affected: entries can repeat, and investigators have not yet established the full source or scope. But even a smaller set of real personal details could help criminals make convincing fake calls or messages. SBI says the incident has not materially affected its operations, financial performance or business continuity, and that its main services continue without disruption. The confirmed exposure therefore raises a customer privacy concern even as the bank reports no service impact. ^2,3

The next step is the independent agency’s detailed review. SBI says it is watching the situation and will take steps to fix problems and prevent them from happening again. The investigation is working to establish whether the records are real, where they came from and what risks they pose. Those findings should clarify what happened and whether customers need to take further action. For now, the confirmed number is 3,897 records containing personal information, not 375,000 confirmed affected customers. ^1,2