The State Bank of India (SBI), the country's largest lender, has reported a suspected disclosure of customer data on the darknet. Preliminary analysis identified 3,897 customer records containing personally identifiable information (PII).
According to the announcement made to stock exchanges, the bank received warnings on October 16 from its threat intelligence service provider—the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In)—regarding the alleged leak of customer data on the darknet.
An initial analysis of approximately 375,000 records available on the darknet allowed for the identification of 3,897 customer records with personal information. This information included registered mobile phone numbers, dates of birth, names, gender, email and residential addresses, branch and customer information file (CIF) identifiers, as well as lead identifiers and metadata associated with credit and lead records.
SBI stated that a detailed investigation is required to establish the authenticity and completeness of the disclosed data, determine the potential source and scale of the leak, and assess the risks to customers and the bank.
The lender activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency accredited by CERT-In to conduct a comprehensive assessment and investigation into the alleged compromise.
The bank reported that it is conducting a detailed assessment and implementing appropriate preventive and corrective measures as circumstances require. The bank emphasized that the incident did not significantly impact its core operational processes, financial performance, or business continuity, and its key functions continued to operate normally.