SBI flags ‘loss of certain data’ as 3,897 customer records surface on dark web

The State Bank of India (SBI) on Wednesday informed the Bombay Stock Exchange and the National Stock Exchange that it had suffered “an incident involving the loss of certain data,” with 3,897 customer records containing personal information identified within a larger trove of about 3.75 lakh records on the dark web.

In a disclosure under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, the bank said it learnt about the incident on October 16 through its threat intelligence provider, the Defence Cyber Agency and Cert-In. The exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF (Customer Information File) identifiers, lead IDs, and metadata linked to loan records and other files.

SBI said it had activated its incident response protocols and engaged an independent Cert-In-empanelled agency to establish the authenticity of the data, its source and the extent of the exposure. It said the incident has no material impact on its core operations, financial performance or business continuity. The filing, however, does not mention how the data left the bank’s systems.

HT reached out to the Ministry of Electronics and IT (MeitY), Cert-In and SBI, but did not get a response immediately.

The 3,897 records are a tiny fraction of SBI’s base of more than 50 crore customers. This is roughly 0.0007%, or about one in 1.36 lakh customers. But the figure comes from what SBI calls a “preliminary analysis”. The disclosure does not say what the remaining records contain, whether they relate to SBI customers, or how many people they cover.

Digital rights group Internet Freedom Foundation (IFF) said that on the day SBI received the alert, a threat-monitoring account on X flagged a claim by a group calling itself “Siriusim.” The group claimed to have released 3.75 lakh rows of SBI data and 2,722 PDF documents, including loan applications and account-opening forms. SBI’s disclosure does not mention the documents.

IFF said SBI has not said whether it has informed any affected customer. It said that those whose phone numbers, dates of birth and addresses are exposed may prove to be probable targets for fraudsters posing as bank officials.

IFF called on SBI to notify every affected customer directly through SMS, email and letter, in English, Hindi and the regional language of the customer’s branch about the incident. The group said there is currently no law in force that mandates banks to inform customers but section 8(6) of the Digital Personal Data Protection Act, 2023 requires a breach to be reported to the Data Protection Board and to each affected person, and Rule 7 of the DPDP Rules, 2025 sets out how.

IFF said as both provisions are scheduled to come into force only on May 13, 2027, it has asked MeitY to bring the DPDP provisions into force immediately.

IFF has also asked for a helpline, a facility to check whether one’s data is affected, and disclosure of whether KYC documents such as Aadhaar, PAN or passport copies were exposed. It further asked the bank to disclose, once the investigation ends, whether the data left through a vendor or a direct selling agent.