SBI confirms cyberattack, 3,897 customer records stolen and put on dark web

SBI confirmed that hackers had breached customer records and that 3,897 records containing personally identifiable information were suspected to be exposed. The information was found on the dark web, a part of the internet associated with hidden services and restricted access. The discovery matters because the records could reveal details about real bank customers.

SBI said a preliminary review examined about 3,75,000 records found online. That analysis identified 3,897 customer records. The exposed material reportedly included names, mobile numbers, dates of birth, gender, email addresses, residential addresses, customer identifiers, and loan-related metadata.

The bank said the incident did not materially affect core operations, financial performance, or business continuity. SBI activated cyber incident response and containment protocols. It is still investigating the data’s authenticity, completeness, possible source, total exposure, and risks to customers and the bank.

The dark web is a portion of the internet that is not normally reachable through standard browsers or listed by ordinary search engines. Access commonly involves special software or network configurations. It is different from the ordinary, or surface, web, which includes public websites people can find through search engines and visit directly.

In this case, SBI customer records were reportedly found on a dark-web forum environment. The article says an anonymous hacker group called Siriusim claimed on BreachForums that it had obtained information relating to 3.75 lakh SBI customers. SBI has not named the group involved.

The dark web is not automatically illegal, but hidden services can make it harder to identify users and remove material. That can make stolen data attractive to criminals. SBI is investigating whether the exposed records are authentic and complete, where they came from, and what risks they create.

SBI’s preliminary analysis of about 3,75,000 records found on the dark web identified 3,897 customer records containing personally identifiable information. This is the confirmed set described by the bank, while the larger figure represents the records examined. The distinction matters because SBI is still checking authenticity and completeness.

The exposed details reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, and residential addresses. The records also included branch identifiers, customer information file identifiers, and lead IDs. They contained metadata linked to loan and lead records and other related files.

The information could connect a person’s identity and contact details with their relationship to the bank and possible loan activity. SBI said it was investigating the potential source, the extent of exposure, and associated risks. It also said the incident did not disrupt core banking operations.

A bank’s customer records and its live transaction systems are related but not identical. Attackers may access or copy stored files without disrupting the systems that handle deposits, withdrawals, payments, or other core services. That is how a data breach can occur while ordinary banking continues.

SBI said exposed records included personal details, customer identifiers, and metadata linked to loan and lead records. These records were reportedly found on the dark web. At the same time, the bank said its core business functions continued to operate normally without disruptions.

The bank stated that the incident had not materially affected core operations, financial performance, or business continuity. It activated cyber incident response and containment protocols. However, normal service does not mean the incident is harmless or fully understood. SBI said it still needed to confirm the data’s authenticity, completeness, source, extent, and risks.

When names, phone numbers, addresses, IDs, and loan details are exposed together, criminals may gain a detailed profile of a customer. Such information can support impersonation, targeted phishing, fraudulent applications, unwanted contact, or attempts to pressure victims. These are general risks of exposed personal data; SBI has not confirmed which of them occurred here.

The article says the records included names, dates of birth, gender, mobile numbers, email addresses, residential addresses, branch and customer information file identifiers, lead IDs, and loan-related metadata. That combination can make fraudulent messages appear more believable because they may reference real personal or banking circumstances.

SBI said the incident did not disrupt core banking and did not report money being taken directly from accounts. The bank is still assessing the data’s authenticity, completeness, source, exposure, and risks. Customers should treat unexpected requests for information cautiously while the investigation continues.

Threat-intelligence providers monitor information about cyber threats, including signs that stolen data may be circulating online. A defence cyber agency can contribute government cybersecurity expertise and warnings. CERT-In is India’s national computer emergency response organisation, which coordinates responses to significant cyber incidents. These roles help organisations detect problems earlier.

According to SBI, it received an alert on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In. The warning concerned suspected exposure of customer data. SBI then conducted a preliminary analysis of about 3,75,000 records and identified 3,897 customer records containing personal information.

The article does not assign separate actions to each notifying body. It says SBI promptly activated cyber incident response and containment protocols. The bank is continuing a detailed investigation to establish authenticity and completeness, identify the possible source, determine the exposure, and assess risks. It will take measures under applicable regulatory requirements.

Personally identifiable information, or PII, is information that identifies a person or can be linked to that person. Examples in this incident include names, phone numbers, dates of birth, email addresses, residential addresses, and customer identifiers. The article uses the term for the customer records SBI found exposed.

PII can be valuable without money being removed from an account because it helps build a credible picture of a victim. Criminals may use matching names, contact details, addresses, and loan-related information to impersonate people or create convincing messages. The article does not state that these specific uses occurred, but they are established risks of exposed identity data.

SBI said core banking operations continued normally and did not report direct account theft. However, it is investigating the records’ authenticity, completeness, source, scope, and possible risks. The incident shows why protecting customer information matters beyond protecting immediate transactions.