The State Bank of India (SBI), the country’s largest public-sector lender, disclosed on Wednesday, October 21, that a cyberattack had exposed the personal and loan-related information of 3,897 customers on the dark web. The bank has appointed an independent cybersecurity agency to investigate the incident and assess the extent of the breach.
According to SBI’s preliminary assessment, the compromised information includes customers’ names, mobile numbers, dates of birth, email addresses, residential addresses, customer identification details and loan records.
The bank stated that the incident was not expected to have a material impact on its core operations, financial performance or business continuity. However, the exposure of sensitive customer information has raised concerns about possible identity theft, financial fraud and targeted cyberattacks.
Cybercrime Group Claims Responsibility
According to CyberPulse, an account on X that monitors cybersecurity incidents, a group identifying itself as Siriusim claimed responsibility for the breach. The account reported that the allegedly stolen data first appeared online on October 16, five days before SBI publicly disclosed the incident.
CyberPulse reported that the leaked material consisted of approximately 375,000 rows of comma-separated values (CSV) data and 2,722 PDF documents. The files allegedly contained loan applications, supporting documents, account-opening forms and other application-related records.
However, the authenticity of the leaked material and the full extent of the data exposure have yet to be independently established.
Cybersecurity experts warn that such information, if exploited by criminals, could facilitate identity theft, financial fraud, targeted phishing campaigns and fraudulent loan applications. The combination of personal details, residential addresses and loan records could also enable scammers to impersonate bank officials and deceive customers through convincing calls, emails or messages.
What SBI Customers Should Do
The incident highlights growing cybersecurity challenges facing India’s banking sector, where financial institutions remain potential targets for organised cybercriminal groups.
SBI customers are advised to remain vigilant against unsolicited calls, text messages and emails claiming to originate from the bank, particularly those involving loan approvals, Know Your Customer (KYC) updates or account-related issues.
Customers should follow these precautions:
- Never share sensitive credentials: Do not disclose one-time passwords (OTPs), PINs, passwords or card verification values (CVVs) to anyone.
- Avoid suspicious links: Do not click on unknown links or open unexpected email attachments.
- Verify communications: Confirm requests for sensitive information through SBI’s official communication channels.
- Monitor account activity: Check transactions regularly and promptly report any suspicious activity to the bank.
- Beware of impersonation scams: Treat unexpected calls or messages requesting personal or financial information with caution.
SBI’s investigation is expected to examine how the breach occurred, verify the information allegedly exposed and determine the potential risks to affected customers.
The incident serves as a reminder of the importance of protecting customer data and strengthening cybersecurity safeguards across the banking and financial services sector.