SBI is investigating a suspected data breach after 3,897 customer records containing personal information were reportedly found on the dark web, raising concerns about banking data security and customer privacy.
The State Bank of India (SBI), the country’s largest public sector lender, has reported a suspected data breach after 3,897 customer records containing personal information were identified in data found on the dark web. The incident has raised concerns about customer privacy, data protection and cybersecurity in India’s banking sector.
According to reports, SBI received alerts on October 16 regarding the suspected exposure of customer information on the dark web. The alerts reportedly came from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
During its preliminary assessment, the bank examined approximately 3.75 lakh records available online. Of these, 3,897 records were identified as containing personally identifiable information associated with SBI customers.
The investigation is ongoing, and the complete extent and source of the suspected data leak have not yet been established.
The preliminary findings indicate that the exposed records contained several categories of personal and banking-related information, including:
-Customers’ names, registered mobile numbers and dates of birth.
- Email addresses, residential addresses and gender details.
- Bank branch information and Customer Information File (CIF) identifiers.
- Lead IDs and information associated with loan applications and customer leads.
Such information could potentially be misused for identity fraud, targeted phishing attacks and impersonation scams. However, the reported exposure of personal records does not automatically mean that banking passwords, PINs or account balances were compromised.
Following the alerts, SBI reportedly activated its cyber incident response and containment protocols. The bank also engaged an independent cybersecurity agency empanelled by CERT-In to assess the incident.
The investigation aims to verify the authenticity of the exposed records, determine the possible source of the leak and evaluate the risks to customers. Authorities and cybersecurity experts are expected to examine how the information became accessible and whether additional records were affected.
SBI has indicated that the incident has not materially affected its core business operations, financial performance or business continuity. Its regular banking services continue to operate normally.
Customers should remain cautious about unexpected calls, emails and text messages claiming to be from SBI. Cybercriminals may use personal information to make fraudulent communications appear genuine.
Customers should never share their One-Time Passwords (OTPs), PINs or banking passwords with anyone. They should also avoid suspicious links, verify requests through official SBI channels and regularly check their bank statements for unauthorised transactions. Any suspicious communication or financial activity should be reported to the bank immediately.
The recent alleged breach of data at SBI underscores the rising issue of cybersecurity within financial institutions, especially as banking is moving towards an increasingly digital world. The protection of customers’ personal information demands constant vigilance, good security systems and response procedures.
The investigations into the case will play a vital role in understanding the extent of the exposure as well as the means through which such cases can be prevented. Communication will be key in ensuring customer confidence within the Indian banking system.
Also read: GTA6 Gameplay before GTA6? The Cyberleek Controversy
Explore our upcoming features, author interviews, and deep-dives into new policy reforms.
