Overview
- SBI said in a stock‑exchange filing Wednesday, Oct 21 that a preliminary review of roughly 375,000 records circulating on the dark web identified 3,897 customer records containing personally identifiable information.
- The bank reported the exposed fields include names, registered mobile numbers, dates of birth, email and residential addresses, branch and CIF identifiers, lead IDs and loan‑related metadata, which security experts say can enable identity theft and targeted phishing.
- A threat actor calling itself Siriusim posted on a cybercrime forum that it held about 375,000 CSV rows and 2,722 PDFs linked to SBI, a claim flagged by CyberPulse56 and partially examined by media that found some sample phone numbers appeared plausible.
- SBI said it received alerts on Oct 16 from its threat‑intelligence provider, the Defence Cyber Agency and CERT‑In, and that it activated incident‑response measures and appointed an independent CERT‑In‑empanelled firm while core banking operations remain materially unaffected.
- Forensic work is ongoing to verify authenticity, trace the data’s source and size, and assess customer risk; customers should watch for suspicious calls or messages, monitor accounts, and follow official SBI guidance as regulators review the case.