Habla con un experto
PreciosNoticiasHabla con un experto
Volver a la sala de prensa
Brecha

State Bank of India Confirms 3,897 Customer Records Exposed on the Dark Web

SBI found 3,897 of its customer records inside a ~375,000-record dataset offered online. The origin is still unknown — but the exposed details are ideal fuel for bank-impersonation scams.

4T4Tify Team4Tify
Oct 21, 2026·5 min de lectura
State Bank of India Confirms 3,897 Customer Records Exposed on the Dark Web

State Bank of India Confirms 3,897 Customer Records Exposed on the Dark Web

India's largest lender has confirmed that personal data belonging to some of its customers is circulating on the dark web. In a stock-exchange filing dated 21 October 2026, State Bank of India (SBI) said it had identified 3,897 customer records inside a much larger set of roughly 375,000 records offered online — and that it does not yet know where the data originated.

What happened

SBI says it was alerted on 16 October through its threat intelligence provider, CERT-In (India's national computer emergency response team) and the Defence Cyber Agency. The bank activated its incident response and containment procedures and brought in an independent, CERT-In-empanelled auditing firm to assess what it describes as "the alleged compromise".

According to the filing, the exposed fields reportedly include:

  • registered mobile numbers, names, gender and dates of birth
  • email and residential addresses
  • branch details and CIF (Customer Information File) identifiers — the bank's internal customer ID
  • lead IDs and metadata tied to loan and lead records

Account numbers, balances, passwords, one-time passcodes, card details and government ID numbers such as PAN or Aadhaar are not among the listed categories. The bank says the incident has had no material impact on its operations, financial performance or business continuity.

The count is preliminary. SBI has not said whether the 3,897 records map to 3,897 distinct people, what the remainder of the dataset contains, or whether any customers will be notified.

The claim behind it

The ~375,000 figure matches a listing on a cybercrime forum, where an actor using the name "Siriusim" advertised a CSV of 375,000 rows plus 2,722 PDF documents allegedly linked to SBI — loan applications, account-opening forms, KYC files and supporting documents. Sample records posted alongside the listing appear to contain genuine phone numbers and KYC material, but a handful of samples does not prove the whole set is authentic.

Crucially, it is still unconfirmed whether any SBI system was breached. The samples were largely loan-related and could have come from SBI itself, one of its subsidiaries, or a third-party provider that handles banking applications. SBI has not said whether the 2,722 PDFs were part of what it examined. It is also not the first such case this year: in July, Bank of Baroda disclosed a similar "alleged compromise", with business email compromise named as the preliminary cause.

Why it matters

Even without passwords or card numbers, this is exactly the data fraudsters need. A caller who knows your name, mobile number, date of birth, branch and internal customer ID can convincingly pose as your bank — and KYC documents make the pretext even stronger. Expect targeted vishing, SMS phishing and loan-related scams rather than direct account takeover.

For organisations, the case is a reminder that your data can leak through someone else's system: loan processors, document handlers and other partners often hold the same sensitive records as the core bank.

What to do

If you are an SBI customer:

  • Treat unsolicited calls, SMS or WhatsApp messages "from the bank" with suspicion — even if they quote your personal details correctly.
  • Never share OTPs, PINs or passwords; the bank will not ask for them.
  • Report suspicious contact to the bank's official phishing channel or India's national cybercrime helpline (1930).

If you run a financial or data-heavy business:

  • Map which third parties process customer and KYC data, and hold them to the same security and logging standards as your own systems.
  • Minimise and expire data in loan and onboarding pipelines — records that don't exist can't leak.
  • Prepare customer-communication playbooks for "data found online, origin unknown" scenarios.
  • Watch for your data where it actually surfaces. Leaks like this are often visible on criminal forums days before anyone confirms them; our Deep/Dark Web monitoring service tracks those spaces for your domains, brands and customer data, so your team can start containment and verification as early as possible.
COMPARTIR