New Delhi: State Bank of India (SBI), the country's largest lender, has flagged the suspected exposure of 3,897 customer records containing personal information on the dark web and launched an investigation into the incident.

The exposed data reportedly includes customers' names, registered mobile numbers, dates of birth, email IDs and residential addresses, along with branch and Customer Information File (CIF) identifiers, lead IDs and metadata linked to loan and lead records.

In a filing on the stock exchanges on Wednesday, SBI said it had received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) on October 16 regarding the suspected exposure.

A preliminary analysis of approximately 375,000 records found on the dark web identified 3,897 customer records containing personally identifiable information (PII), the bank said.
Also read | Kerala’s NRI deposits top Rs 3.35 trillion, nearing a third of bank deposits

SBI launches cybersecurity probe

SBI said it had activated its cyber incident response and containment protocols after receiving the alerts. It has also engaged an independent cybersecurity agency empanelled by CERT-In to investigate the incident.

The investigation will seek to establish the authenticity and completeness of the exposed data, identify the potential source and extent of the exposure, and assess the risks to customers and the bank.

The lender said it was continuing its assessment and implementing appropriate remedial and preventive measures.

SBI said the incident had no material impact on its core business operations, financial performance or business continuity.

The bank added that its core functions continued to operate normally without disruption and that it was monitoring the situation closely.
Also read | Jio IPO anchor book draws record Rs 2.5 lakh crore demand; LIC, BlackRock, Capital Group lead allocations

Hacker group had claimed access to SBI data

Earlier in the week, a hacker group operating under the name 'Siriusim' allegedly claimed to have obtained confidential customer information linked to SBI, including personal details, loan applications and account-opening documents.

The claim was highlighted by cybersecurity monitoring account CyberPulse56 in a post on social media platform X. According to the post, the group purportedly possessed 3.75 lakh data entries in CSV format (Comma-Separated Values) and 2,722 PDF documents associated with the bank.

SBI's preliminary findings have identified 3,897 records containing personal information among the approximately 3.75 lakh records analysed. The bank's detailed investigation is expected to establish the authenticity, completeness and possible source of the exposed data.