State Bank of India (SBI), the country's largest public sector lender, disclosed on Wednesday that it had found 3,897 customer records containing personally identifiable information on the dark web, according to its stock exchange filing and reports by YourStory and MediaNama.

Source: YourStory

The bank said it received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about the suspected exposure. In a preliminary review of around 3.75 lakh records circulating on the dark web, it identified the 3,897 records.

The exposed information includes names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses, as well as branch and Customer Information File (CIF) identifiers, lead IDs and metadata linked to loan and lead records, MediaNama reported, citing SBI's filing. The filing did not list passwords, PINs or one-time passwords among the exposed fields.

Investigation under way

SBI said it activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled with CERT-In to verify the authenticity and completeness of the data, trace the possible source, assess the extent of exposure and evaluate risks, Digit and Cybersecurity News reported.

The disclosure follows a claim last week by a threat actor using the name 'Siriusim' on BreachForums, who claimed to possess 3.75 lakh customer records and 2,722 PDF documents linked to SBI. That claim is separate from SBI's own preliminary findings, and the bank has not attributed the incident to a named attacker.

SBI said the incident would have no material impact on its core business operations, financial performance or business continuity, and that its services continued to operate normally. It said remedial and preventive measures were being implemented.