Overview
- The bank said it received threat alerts on Friday and, in a preliminary review of about 375,000 records found online, identified 3,897 customer records containing personally identifiable information.
- The exposed fields reportedly include names, registered mobile numbers, dates of birth, email and residential addresses, branch and CIF identifiers, lead IDs and loan‑related metadata.
- SBI has activated its cyber incident response, told stock exchanges about the suspected exposure on Wednesday, and engaged an independent CERT‑In‑empanelled cybersecurity firm to run a full forensic investigation.
- Investigators have not yet verified the dataset's authenticity, origin, recency or completeness, and independent sample checks by reporters showed a few matching records but do not prove provenance for the whole set.
- If validated, the data could fuel targeted phishing, identity theft and fraudulent loan applications, and the case has drawn involvement from CERT‑In, the Defence Cyber Agency and heightened regulatory scrutiny of bank data controls.