SBI data leak: Nearly 4,000 customer records found on dark web; what we know so far

Personally identifiable information, or PII, is information connected to a specific person. It can include direct identifiers, such as a name or phone number, and linked details, such as an address, customer identifier, or loan record. Its exposure matters because it may reveal sensitive details about customers and create security risks.

SBI said 3,897 customer records contained PII among roughly 3,75,000 records examined on the dark web. The information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and loan or lead metadata.

The bank has not yet confirmed that every record is genuine or complete. Its investigation is examining the data's authenticity, source, and extent. SBI has activated incident-response and containment procedures and engaged an independent cybersecurity agency empanelled by CERT-In. Core banking operations remain unaffected, the bank said.

SBI's preliminary analysis covered approximately 3,75,000 records available on the dark web. Of those, 3,897 records were identified as containing customer personally identifiable information. These figures describe the initial review, not a final confirmed count of affected customers.

The records were screened for information linked to customers. SBI said the potentially exposed material included names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and loan or lead metadata. The bank also referred to other related files.

The numbers may change as the investigation progresses. SBI is checking whether the records are authentic, where they came from, and how extensive the alleged exposure is. It has activated cyber incident-response and containment protocols. An independent agency is assessing the compromise and possible risks to customers and the bank.

The dark web is a part of the internet that is not normally indexed by standard search engines and requires specialised access tools or services. It can host legitimate privacy-focused activity, but it is also used to circulate stolen or allegedly stolen information. That makes it a place where organisations may discover claims about compromised data.

In SBI's case, approximately 3,75,000 records were reportedly available on the dark web. A preliminary review found 3,897 records containing customer PII. CyberPulse56 said the group Siriusim claimed to possess around 3.8 lakh CSV entries and 2,722 PDF documents linked to SBI.

The presence of files there does not automatically prove that they came from SBI or are genuine. The bank said authenticity, source, and extent remain under investigation. SBI has activated response and containment protocols while an independent cybersecurity agency assesses the alleged compromise and potential risks.

The unidentified hacker group Siriusim claimed it had obtained confidential information allegedly linked to SBI. The claimed material included personal details, loan applications, account-opening documents, residential addresses, supporting documents, and other application-related records. CyberPulse56 highlighted the claim on X.

According to CyberPulse56, Siriusim purportedly possessed around 3.8 lakh data entries in CSV format and 2,722 PDF documents. The account first reported the claim on October 16 and described it as the group's first disclosure of the dataset. These figures describe the group's alleged possession, not a confirmed SBI breach.

SBI has not validated the claim. Its preliminary analysis found 3,897 records containing PII among approximately 3,75,000 dark-web records, but the bank is still examining authenticity, completeness, source, and extent. It has engaged an independent cybersecurity agency empanelled by CERT-In to assess the alleged compromise and risks.

If the exposed information is authentic, criminals could use it to build convincing messages around a customer's identity, address, bank relationship, or loan activity. Such messages might try to make a customer reveal passwords, verification codes, or other confidential information. The article does not report any confirmed customer harm, but SBI is assessing the potential risks.

For example, a criminal who knows a customer's name, mobile number, address, and loan details could pose as a bank representative. A message mentioning a real loan application may appear credible and pressure the person to respond or open a harmful attachment. Personal details could also support identity theft or fraudulent applications.

These outcomes are potential risks, not confirmed consequences in this incident. SBI said the investigation is examining the data's authenticity and extent. The bank has activated containment protocols and is implementing remedial and preventive measures. It also said core business, financial performance, and continuity were not materially affected.

SBI began its response after receiving alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In. The bank activated cyber incident-response and containment protocols. These steps are intended to investigate the alleged exposure, limit potential harm, and guide further protective action.

SBI also engaged an independent cybersecurity agency empanelled by CERT-In. The agency is assessing the alleged compromise and potential risks to customers and the bank. Its work includes examining whether the records are authentic and complete, identifying the possible source, and determining the exposure's extent. SBI said remedial and preventive measures were being implemented as required.

CERT-In is involved both through the alert cited by SBI and through its empanelled agency framework. The article does not describe a separate operational role for CERT-In in the investigation. SBI said it would continue monitoring the situation and comply with applicable regulatory requirements, while core functions continue normally.

Names, phone numbers, addresses, and loan details create a detailed picture of a person. When combined, they can make an unsolicited call, email, or message appear to come from a trusted bank or to concern a real application. This is why leaked data can strengthen phishing, identity theft, and other social-engineering attempts.

For instance, a criminal could mention a customer's name, address, branch, or loan lead while claiming that an application needs urgent action. The familiar details may lower suspicion. The criminal could then try to obtain additional confidential information, redirect communication, or misuse the person's identity. The article reports these categories of data but does not confirm that such misuse occurred.

SBI is assessing the potential risks and has not said that customers suffered confirmed losses. The bank is investigating authenticity and extent, while implementing remedial and preventive measures. Its core business functions continue normally, and the alleged exposure remains under review.