SBI confirms data leak, says 4,000 customer records identified on dark web

The authenticity and full extent of the alleged exposure had not been independently verified in the post.

MUMBAI: SBI has confirmed a data breach involving 3,897 customer records containing personal information, which were found on the dark web.SBI identified the records containing personal information in a preliminary analysis of 3.75 lakh records found on the dark web.The bank said it had activated its cyber incident response protocols and commissioned an independent cybersecurity agency to investigate the incident after receiving alerts from its threat intelligence service provider, Defence Cyber Agency and CERT-In on Oct 16.The disclosure follows a claim by cybersecurity monitoring account CyberPulse that a threat actor using the name Siriusim had leaked documents and personal data allegedly linked to SBI.

The post claimed the dataset contained 3,75,000 rows in CSV files and 2,722 PDF documents, including customer information, loan applications, supporting documents, account-opening forms and addresses.

Independent assessment is under way: SBI

The authenticity and full extent of the alleged exposure had not been independently verified in the post.In its notice to stock exchanges, SBI said the preliminary analysis had identified records containing customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs and metadata associated with loan and lead records.

The leak of PII can lead to impersonation, loan and benefit frauds and existing account takeovers.The bank said a detailed investigation was needed to establish the authenticity and completeness of the exposed data, determine its source and extent, and assess the risks to customers and the bank. It has engaged a cybersecurity agency empanelled by CERT-In, India’s national cyber incident response agency, to conduct an independent assessment. SBI said the incident had no material impact on its core business operations, financial performance or business continuity, adding that its core functions continued to operate normally.

It said the assessment was underway and remedial and preventive measures were being implemented.