SBI Reports Suspected Data Exposure Affecting 3,897 Customer Records

State Bank of India (SBI) has begun investigating a suspected data exposure after identifying personal information in 3,897 customer records found on the dark web. The bank received alerts about the incident last week and has appointed an independent cybersecurity agency to assess the breach. The records reportedly contain customers' personal and contact details, along with information linked to loan records. SBI has said the incident has not materially affected its financial performance, core banking operations or business continuity.

SBI Investigates Customer Data Exposure After Dark Web Alerts

SBI said in its October 21 stock exchange filing that it first received alerts about the suspected data exposure on October 16. The alerts came from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, or CERT-In.

The bank's initial review looked at around 375,000 records found on the dark web and identified 3,897 that contained personal information. These records reportedly included customers' names, dates of birth, gender, registered mobile numbers, email addresses and home addresses. They also contained branch and Customer Information File identifiers, lead IDs, and metadata linked to loan and lead records.

SBI is now checking whether the exposed records are genuine and complete. It is also trying to trace where the data came from, establish how much information was affected and understand the potential risks for customers and the bank.

Following the alerts, SBI activated its cyber incident response and containment procedures. It has also brought in an independent cybersecurity agency empanelled by CERT-In to investigate the suspected compromise. The bank said it was working on measures to address the incident and prevent similar issues.

SBI Data Exposure: Impact on Banking Services

SBI said the incident has not materially affected its financial performance, core business operations or ability to continue its services. Its core banking functions are running normally, with no reported disruption.

The bank is continuing to assess the incident, monitor the situation and put appropriate remedial and preventive measures in place in line with regulatory requirements.