State Bank of India said its review of material found on the dark web identified 3,897 records containing customer personal information, leaving investigators to determine the source and extent of the exposure.
In an Oct. 21 stock-exchange filing, SBI said it had examined about 375,000 records in its initial review. That larger figure is the number of records screened; the filing does not say how many distinct customers appear in the 3,897 identified records.
SBI listed names, registered mobile numbers, birth dates, gender, email and residential addresses, branch identifiers, customer information file identifiers, lead IDs and information associated with loan and lead records. The bank is still assessing whether the data is authentic and complete.
SBI said it received alerts on Oct. 16 from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). It began containment measures and engaged an independent cybersecurity agency to investigate.
The bank described the matter as an “incident involving data loss” but did not identify an attacker or explain how the material reached the dark web. It said the incident had no material impact on core operations, financial performance or business continuity. The filing did not say whether customers whose records were identified had been notified.
Before SBI’s disclosure, CyberPulse described an unverified claim that bank-linked files had been released, as EconoTimes previously reported. The independent agency is investigating the data’s source and the incident’s full extent; SBI gave no completion date.
