The State Bank of India (SBI) has confirmed that a cyber incident exposed customer data online. In a filing with stock exchanges, SBI said it suspects 3,897 customer records containing personally identifiable information were exposed on the dark web. The bank said the incident has not materially affected its core operations, financial performance or business continuity.
On October 16, SBI received an alert from a Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In about suspected exposure of customer data. A preliminary analysis of about 3,75,000 records found on the dark web identified 3,897 records with personally identifiable information.
The exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. The records also included branch and customer information file identifiers, lead IDs, and metadata linked to loan and lead records and other related files.
SBI said its core business functions continue to run normally without disruptions. It said it promptly activated its cyber incident response and containment protocols. It added that a detailed investigation is needed to establish the authenticity and completeness of the exposed data, identify its potential source, determine the extent of the exposure and assess the risks to customers and the bank. The bank said it is monitoring the situation closely. It will take appropriate measures under applicable regulatory requirements as the investigation into the 3,897 records continues.
India Today Tech first reported a potential SBI data breach on October 19. It had reported claims by an anonymous hacker group called Siriusim. The group alleged on the dark web forum BreachForums that it had obtained information relating to 3.75 lakh SBI customers. SBI has not named the group involved.
The incident comes amid increased regulatory focus on cybersecurity in the banking sector. In July, Bank of Baroda acknowledged a data leak that exposed 1TB of customer data.
