The Internet Freedom Foundation asked State Bank of India (SBI) on Oct. 21 to notify affected customers, as the bank investigates personal information identified in records found on the dark web.
SBI said in its Oct. 21 filing that its preliminary review found personal information in 3,897 records out of about 375,000 examined, as EconoTimes previously reported.
The investigation is checking the material’s authenticity and completeness, tracing where it originated and assessing the exposure’s scope. The review identified names, registered mobile numbers, birth dates, gender, email and residential addresses, branch details, Customer Information File identifiers, lead IDs and information tied to loan and lead records.
The Oct. 16 alerts came from three sources, SBI said: the Indian Computer Emergency Response Team (CERT-In), the Defence Cyber Agency and the bank’s threat intelligence provider. The bank began incident response and containment measures and engaged an independent cybersecurity agency empanelled by CERT-In.
In the filing, SBI called it “an incident involving the loss of certain data.” It did not name an attacker or explain how the information reached the dark web. The bank said its core business was operating normally and reported no material financial or continuity impact.
SBI’s filing did not say whether customers had been contacted. The Internet Freedom Foundation, a digital rights group, said it asked SBI to notify every affected customer and explain what information was exposed. The group warned that personal and loan data could be used by someone impersonating a bank employee, but did not report that such fraud had occurred in this case.
The bank gave no completion date for the investigation.
