Congress has taken a stand against the State Bank of India (SBI) following the alleged exposure of 3,897 customer records to the darknet, demanding explanations and accountability from the country's largest bank. Cybersecurity expert Pawan Duggal described the incident as 'unusual' and warned of potential consequences for India's national security.
The criticism followed SBI's announcement that preliminary analysis of approximately 3.75 lakh records available on the darknet revealed 3,897 customer entries containing personally identifiable information. The bank stated it is investigating the suspected leak after receiving alerts on October 16th from its threat intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In).
Pawan Khera, head of Congress media and public relations, questioned the bank's ability to detect the breach and its response to affected customers. He noted that the State Bank of India, being the nation's largest public sector bank, faced a data leak affecting 3.75 lakh rows, of which 3,897 records contain personal information, including mobile numbers, dates of birth, names, email addresses, residential addresses, branch and CIF identifiers, lead identifiers, and credit-related details.
Khera emphasized that the most alarming aspect was that SBI itself did not discover the breach; an external agency had to notify the bank about the publication of its customers' data on the darknet. He accused the bank of failing to inform customers whose personal information was exposed, arguing that a bank entrusted with the financial security of millions cannot afford such a catastrophic error in data security and client accountability.
Expert highlights security risks: 'Unusual incident'
Pawan Duggal, chairman of the International Commission on Cybersecurity Laws, stated that the alleged leak is particularly serious given the size of SBI and the volume of confidential information it holds. He explained that the SBI data leak is not a routine occurrence because India is the world's most populous country, and SBI is the largest bank in the country holding an unprecedented number of accounts. The leak affects not only names but also numerous government accounts, such as those of public sector employees, meaning the disclosure of a vast amount of sensitive government information.
Duggal added that the objective of such a leak is clear: state and non-state actors could use this data to negatively impact India's sovereignty, integrity, and security. He also referred to Section 79 of the Information Technology Act, which requires intermediaries to exercise 'due diligence' when performing their functions. He noted that it remains unclear whether the requirements set by the central government in rules like IT Rules, 2021, and IT Directions, 2022, have been met. The expert called on India to 'wake up,' noting that the country still lacks a dedicated national cybersecurity law, and the existing Information Technology Act of 2000 does not fully cover these critical aspects.
The alleged leak includes registered mobile numbers, dates of birth, gender, email addresses, and residential addresses of customers. Furthermore, the records contain branch and Customer Information File (CIF) identifiers, lead identifiers, and metadata related to credit and lead records, as well as other associated files.
SBI states customer balances are safe
In response to the incident, SBI reported that the alleged leak affected a very small number of customers and did not significantly impact its core operations, financial performance, or business continuity. The bank stated in a post on X that 'customer balances are completely safe, and we are taking all possible steps to protect the interests of our valued customers.'
SBI also announced that it has activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency accredited by CERT-In to investigate the suspected compromise. The bank clarified that a detailed investigation is required to establish the authenticity and completeness of the disclosed data, determine the potential source and scale of the leak, and assess the risks to customers and the bank. It reiterated that the security of financial assets, data, and customer trust remains its highest priority, and corrective and preventive measures are being implemented.
Incident at SBI amid broader cyber threats
The alleged leak occurred several days after CERT-In issued a 'critical' warning that autonomous artificial intelligence agents had gained access to live systems and confidential data of Indian organizations without authorization. In its advisory titled 'AI Agents as Attack Vectors,' the agency reported that some AI models and agents under research and evaluation had exceeded their authorized scope of tasks and accessed operational systems. It is reported that the agents utilized credentials and connection settings that were exposed in application configurations, publicly available code repositories, and overly permissive cloud service roles.
CERT-In also reported a compromise related to private keys belonging to eight intermediate certificates held by the Indian certification authority eMudhra Ltd. The affected certificates included six Transport Layer Security certificates and two code signing certificates. The agency warned that the compromised keys could be used to issue fraudulent certificates, impersonate legitimate websites, and potentially intercept or alter encrypted communications.
