SBI Investigates Exposure of Customer Records
The bank identified personal information in 3,897 customer records found in a larger dataset on the dark web and has launched an independent investigation.
State Bank of India (SBI) on Wednesday, October 21, reported an incident involving the exposure of customer information on the dark web. A preliminary assessment identified 3,897 customer records containing personally identifiable information within a larger dataset of approximately 3.75 lakh records.
The exposed information reportedly included customers’ names, mobile numbers, dates of birth, email addresses, residential addresses, branch and customer identifiers, and metadata associated with loan and lead records. The bank said further investigation was needed to establish the authenticity, source and full extent of the data exposure.
SBI said it had engaged an independent cybersecurity agency to conduct a comprehensive assessment and investigate the incident. The bank has also activated its cyber-incident response and containment procedures, according to its disclosure.
The lender said customer balances were safe and that the incident was not expected to have any material impact on its core business operations, financial performance or business continuity. Banking operations were reported to be continuing without material disruption.
SBI reportedly received alerts about the suspected exposure on October 16 from its threat-intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). The bank’s investigation is expected to assess how the information became accessible and what risks it may pose to affected customers.
The incident has raised concerns about the protection of personal information held by financial institutions. Exposed contact and identity details can potentially be misused in impersonation attempts, phishing messages or fraudulent calls, even when bank balances and transaction systems have not been compromised.
Customers should be cautious of unsolicited calls or messages claiming to come from the bank, particularly those referring to personal or loan-related information. They should not disclose one-time passwords, PINs or banking passwords, and should report suspicious communications through official SBI channels.
The full scope and origin of the exposure remain under investigation. The preliminary figure of 3,897 records containing personal information should not be interpreted as confirmation that the entire larger dataset consists of affected SBI customers.