Nearly 4,000 customers of India's largest public sector lender may have had personal details exposed on the dark web, the State Bank of India disclosed in a stock exchange filing. The bank said it was alerted on October 16 by its threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) to a suspected leak of customer records. A preliminary review of roughly 3.75 lakh data entries found online identified 3,897 records containing personally identifiable information.
What Was Exposed
According to SBI's disclosure, the affected records include names, gender, registered mobile numbers, dates of birth, email addresses and residential addresses. Also present were bank branch identifiers, Customer Information File (CIF) numbers, and lead IDs tied to loan-related records. The bank has not confirmed who is behind the exposure, nor has it verified the authenticity of the broader dataset of 3.75 lakh entries beyond the subset with clear personal identifiers. A threat-monitoring account on social media had earlier claimed that the leak involved around 3.75 lakh rows of data and roughly 2,722 PDF documents, including loan application and account-opening forms, attributed to an entity calling itself "Siriusim." SBI's filing does not name or confirm this entity as the source.
Why This Matters for Customers
Exposed personal data does not, by itself, mean that account balances or banking credentials have been compromised. The greater danger lies in how such information can be weaponised for social engineering. Fraudsters often combine stolen details such as a customer's name, date of birth and branch location to construct convincing phone calls or messages that mimic official bank communication. When a caller already knows personal specifics, victims are far more likely to lower their guard and share sensitive credentials such as OTPs or PINs. This is the mechanism behind a large share of banking fraud in India, and a confirmed data exposure of this scale raises the probability of such targeted attempts in the coming weeks.
Gaps in the Response
The Internet Freedom Foundation, a digital rights organisation, has questioned how the breach was detected and whether affected customers have been individually informed. It noted that SBI learned of the exposure through external alerts rather than internal monitoring, after the data had reportedly already surfaced online. The organisation also pointed out that SBI's filing does not clarify the nature of the remaining records beyond the 3,897 with personal identifiers, leaving ambiguity about the true scale of exposure. It has called on the bank to notify every affected customer directly through SMS, email and physical letters, in English, Hindi and the customer's branch language, along with a dedicated helpline and an online tool to check exposure status. SBI has not confirmed whether such measures are in place.
What Customers Should Do
- Never share OTPs, PINs, passwords or internet banking credentials over a phone call or message, regardless of how convincing the caller sounds.
- Treat unsolicited calls referencing personal or account details with suspicion, even if the caller claims to represent SBI.
- Verify any request independently through SBI's official customer service channels rather than numbers provided by the caller.
- Report suspected fraud promptly to the bank and to India's cybercrime reporting portal.
SBI has said its core banking operations remain unaffected and that the incident has not had a material impact on its financial performance. The bank says it is continuing its investigation to establish the authenticity and origin of the data, and will act in line with regulatory requirements as findings emerge. Until that process concludes, customers are best served by assuming any unexpected contact referencing their banking details could be an attempt at fraud.
