Overview
- The bank said it received alerts on October 16 from its threat‑intelligence provider, the Defence Cyber Agency and CERT‑In and then began a probe that led to a preliminary review.
- SBI told exchanges on October 21 that a review of roughly 375,000 dark‑web rows identified 3,897 customer records containing names, mobile numbers, dates of birth, emails, residential addresses, branch and CIF identifiers and loan metadata.
- On October 23 the lender said it had individually notified the identified customers by email or WhatsApp and reiterated that account balances and funds remain safe.
- A threat actor using the name 'Siriusim' has claimed to be selling the dataset online while investigators continue to confirm whether the posted files are authentic and where they came from.
- Political figures have urged an independent, time‑bound probe and the incident has intensified scrutiny of data‑protection and cyber controls at public‑sector banks while customers are advised to avoid sharing OTPs, PINs or passwords and to monitor credit and account activity.