State Bank of India (SBI), the country's largest lender, has confirmed in a stock exchange filing that a cyber incident exposed customer records on the dark web. Multiple outlets report the filing, and their accounts match. The bank says its preliminary analysis of roughly 375,000 records found on the dark web identified 3,897 customer records containing personally identifiable information (PII). Separately, a hacker group calling itself Siriusim claims to hold about 375,000 records and 2,722 PDF documents linked to SBI, according to the X account CyberPulse56 (via The Economic Times and Moneycontrol). Nobody has independently verified that claim. SBI says its core banking operations were not disrupted. It has also stated that more investigation is needed to establish whether the data is authentic and complete.
What Happened
SBI says that on October 16 it received alerts about suspected exposure of customer data on the dark web. The alerts came from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In), according to the bank's filing as reported by India Today, NDTV, The Economic Times and Mashable India. The bank then activated its cyber incident response and containment protocols. NDTV, Mint and The Economic Times report that SBI also hired an independent cybersecurity agency empanelled with CERT-In to investigate.
Here is how the timeline came together:
- October 16: CyberPulse56 first reported that Siriusim was offering the dataset. The group called it the "first disclosure" of the data (Moneycontrol, Mint). On the same day, SBI received its official alerts.
- October 19: India Today Tech says it first reported a potential SBI breach on this date.
- October 20: The Economic Times and Moneycontrol published the Siriusim claim. At press time, SBI had not responded to ET.
- October 21 (Wednesday): SBI filed its disclosure with the stock exchanges.
Mashable India, citing India Today Tech, reports that Siriusim posted its claim on the BreachForums dark web forum. Only one source reports this, and it is second-hand, so treat it as unconfirmed.
The wording also varies. Indian Express quotes the filing as saying "the bank has experienced an incident involving the loss of certain data." Other reports describe the filing as flagging "suspected exposure" and say the bank still needs to confirm the data is authentic. Some headlines say records were "stolen" (India Today). The bank's own language, as reported, is more cautious: it confirms an incident and a data loss but has not yet established how the data left its environment.
What Was Taken
What SBI has confirmed (per the filing as reported): 3,897 customer records with PII. Mint and Indian Express round this to "nearly 3,900" or "nearly 4,000." The data fields include:
- Customer names, gender and dates of birth
- Registered mobile numbers and email addresses
- Residential addresses
- Branch identifiers and Customer Information File (CIF) identifiers
- Lead IDs
- Metadata tied to loan and lead records and other related files
What Siriusim claims (unverified, via CyberPulse56):
- About 375,000 entries. Moneycontrol and Mint describe them as CSV rows. ET's headline calls them "3.75 lakh accounts."
- 2,722 PDF documents
- Loan applications and supporting documents, account-opening applications, addresses and other application details
How the two numbers fit together: The figures are less contradictory than they look. SBI's filing confirms that a set of about 375,000 records exists on the dark web, which matches the size of Siriusim's claim. However, the bank's preliminary review found PII in only 3,897 of those records. Moneycontrol points out that the number of entries does not show how many individual customers are affected, so the ET headline's "3.75 lakh accounts" overstates what anyone has confirmed. The reported confirmed exposure is 3,897 records. The upper bound is the attacker's claim of about 375,000 rows plus 2,722 documents. SBI has not said whether it has reviewed the 2,722 PDFs.
NDTV reports no evidence so far that account credentials or funds were compromised.
Why It Matters
The confirmed number is small for a bank with SBI's customer base, but the kind of data matters more than the volume. Names, dates of birth, registered mobile numbers and addresses, combined with CIF identifiers and loan-lead metadata, are exactly what a convincing banking impersonation call or message needs. A fraudster who can quote a customer's CIF number and a pending loan application sounds like the bank. CyberPulse56 warned that, if genuine, the data could enable identity theft, financial fraud, targeted phishing and fraudulent loan applications.
The "lead" and loan-application references are also worth noting. Lead records usually sit in loan-origination, CRM or sourcing systems, which are often run by or shared with partners. These systems are often less tightly protected than core banking. This fits the bank's statement that core operations were unaffected. It is an inference, though, not a confirmed finding.
The incident also comes at a tense time for Indian finance:
- Indian Express reports that CERT-In disclosed last week that AI models had gained unauthorised access to confidential information at some Indian organisations, reportedly mostly in the financial sector.
- Moneycontrol, citing The Economic Times on October 15, reports that around 20 banks, NBFCs and fintechs were recently hit by attacks that allegedly exploited stolen credentials and flaws in payment APIs.
No source links the SBI incident to either of these campaigns.
The Attack Technique
The intrusion vector is unknown. SBI has not said how the data was obtained, which system it came from, or whether a third party was involved. Mashable India reports that the bank is still investigating where the records came from and how they ended up online. Siriusim has not publicly described its method in any of the reporting. Attribution to Siriusim rests only on the group's own claim as relayed by CyberPulse56. SBI's filing, as reported, does not name a threat actor.
Based on the data types (loan/lead metadata, application PDFs, account-opening forms), likely sources include loan origination or lead-management platforms, document stores, or a sourcing or outsourcing partner. Given the sector-wide reports of credential theft and API abuse, defenders should treat those as possible vectors. None of this is confirmed for SBI.
What Organizations Should Do
- Inventory and harden lead and loan-origination systems. Treat CRM, DSA/partner portals and document repositories that hold application PDFs with the same care as core banking: MFA everywhere, least-privilege access and centralised logging.
- Audit APIs and service credentials. Rotate long-lived API keys and service account secrets. Enforce authentication and rate limits on payment and data APIs. Alert on bulk record pulls or unusual pagination patterns.
- Get third-party access under control. List every vendor and partner with access to customer PII or loan documents. Check their logging and require breach notification terms.
- Monitor dark web and threat intelligence feeds. SBI learned of the exposure from outside alerts. Make sure feeds from your own provider and CERT-In are routed to someone who acts on them.
- Prepare customers for follow-on fraud. Warn affected customers about calls, SMS or emails that use their personal and loan details. Remind them that the bank will never ask for OTPs, PINs or passwords. Watch for fraudulent loan applications that use exposed identities.
- Apply DLP to bulk exports. Flag or block large CSV exports and mass PDF downloads from internal applications, especially by accounts that don't normally do this.
Sources: SBI confirms cyberattack, 3,897 customer records stolen and put on... | SBI data breach claim: Hackers allegedly access 3.75 lakh accounts... | SBI Data Leak: What Happened, What Data Was Leaked And What Account... | SBI data leak explained: What customer information was exposed online? | State Bank of India confirms cyberattack, data of 3,900 customers e... | SBI flags dark web exposure of 3897 customer records | SBI Cyberattack Exposes Customer Data: Names, Phone Numbers, IDs an... | SBI data breach claim: Hacker group alleges access to 3.75 lakh rec...