State Bank of India (SBI) said it notified customers linked to personal information in dark web material, while its review has yet to establish how many individuals the records represent.
The bank said Oct. 23 that notices went out through email or WhatsApp. It also told recipients their account funds were safe, but did not say how many people it contacted.
SBI said its preliminary review linked personal information in 3,897 records to the bank’s customers. Those records came from a collection of about 375,000 that the bank examined. The record count does not establish how many distinct people are represented, and SBI has not confirmed the material’s authenticity, completeness or origin.
The notification update follows the bank’s earlier disclosure of customer-linked information in dark web material, as EconoTimes previously reported.
SBI said alerts reached it Oct. 16 from three sources: the Indian Computer Emergency Response Team (CERT-In), the Defence Cyber Agency and its threat intelligence provider. The bank took steps to contain the incident and engaged an independent cybersecurity agency on CERT-In’s panel.
SBI said its core functions kept operating normally, and the incident did not materially affect its financial performance or ability to continue business. The investigation is ongoing, and the bank has not announced a completion date.
