The State Bank of India (SBI) on Wednesday confirmed a cyberattack that led to the exposure of personal information belonging to 3,897 customers on the dark web.
According to the bank’s preliminary analysis, the leaked data included customers’ names, mobile numbers, dates of birth, email addresses, residential addresses, customer identifiers and loan records.
SBI has engaged an independent cybersecurity agency to conduct a detailed assessment and investigate the nature and extent of the data leak.
The bank stated that the incident is not expected to have any significant impact on its core business operations, financial performance or business continuity.
The incident comes amid growing concerns over cybersecurity threats targeting financial institutions, with India’s banking regulator urging lenders to strengthen their digital security systems.
Who Is Behind the Cyberattack?
According to CyberPulse, an account on X that tracks cybersecurity incidents, the attack was allegedly carried out by a group identified as Siriusim. The incident was first reported on October 16.
The reported leaked data includes:
- 375,000 rows of CSV data
- 2,722 PDF documents
- Personal information of customers
- Loan applications and supporting documents
- Account-opening applications
- Residential addresses and other application-related details
CyberPulse warned that the exposed information could be misused for identity theft, financial fraud, targeted phishing attacks and fraudulent loan applications.
What Should SBI Customers Do?
Prashant Mali, a Mumbai-based lawyer and expert in cyber law, artificial intelligence and data protection, warned that cybercriminals could use the stolen information to target customers with fraudulent calls and messages.
He advised SBI customers to take the following precautions:
- Never share sensitive information: Do not disclose your OTP, PIN, password or CVV to anyone.
- Verify suspicious calls: Independently confirm unexpected calls or messages related to loans, KYC verification or account issues.
- Avoid suspicious links: Do not click on unknown links or open unexpected email attachments.
- Monitor account activity: Regularly check bank transactions and report any unauthorised activity immediately.
- Contact SBI through official channels: Report suspicious calls, messages or transactions directly to the bank.
Customers should remain alert to suspicious communications and remember that scammers may use personal information to make fraudulent messages appear genuine.