Personal details of nearly 3,900 SBI customers leaked on dark web in cyberattack

SBI said leaked records included several details that can identify customers directly. These were names, mobile numbers, dates of birth, gender, email addresses and residential addresses. Such information matters because it can reveal who a person is and how they can be contacted.

The bank said about 3.75 lakh customer records were compromised. Of these, 3,897 contained personally identifiable information, or information linked to identifiable people. The data had already appeared online, according to the account reported by the Internet Freedom Foundation.

SBI said the leak was not expected to affect its operations or financial performance. However, the bank hired an independent cybersecurity agency to assess the incident and investigate its nature and extent. The Internet Freedom Foundation urged SBI to tell affected customers what was exposed and how to protect themselves.

The dark web is a part of the internet that is not openly searchable through standard search engines. Access usually requires special software or networks designed to conceal users and website locations. The article does not define it, but established cybersecurity knowledge describes it as a place where hidden online services operate.

That secrecy can make the dark web attractive for publishing or trading stolen information. Criminals may use hidden marketplaces or forums to advertise databases, exchange files or test whether data is valuable. A leak can therefore spread beyond the organisation that originally held it.

In this case, SBI said roughly 3.75 lakh records were compromised, while the Internet Freedom Foundation said the data had been published online. SBI learned of the breach from external agencies, according to the organisation. An independent cybersecurity agency is investigating how extensive the exposure was.

SBI’s preliminary investigation found that more than 3.75 lakh customer records had been compromised. Among them, 3,897 contained personally identifiable information, or PII. PII is data that can identify a person, such as a name, phone number or address.

The figures describe two different parts of the incident. The larger number covers all compromised records. The smaller number identifies records containing the personal details listed by SBI: names, mobile numbers, birth dates, gender, email addresses and residential addresses. The data was published on the dark web.

The figures remain preliminary because SBI engaged an independent cybersecurity agency to assess the breach and investigate its nature and extent. The Internet Freedom Foundation said SBI did not yet know how the data left its systems. SBI said the incident was not expected to affect operations or financial performance.

Names, phone numbers, birth dates, email addresses and home addresses give outsiders several ways to identify and contact a person. When combined, these details can make fraudulent messages or calls appear more believable. They can also help someone impersonate a customer or target that person with carefully tailored scams.

For example, a criminal could use a real name, mobile number and residential address in a message pretending to represent a bank. A birth date or gender detail might make the message seem more convincing. The article does not report confirmed losses or misuse by affected SBI customers, so these are possible risks rather than established outcomes.

The Internet Freedom Foundation urged SBI to tell affected customers what information was exposed and what protective steps to take. SBI said the leak was not expected to affect operations or financial performance. Its independent cybersecurity agency is assessing the incident and its extent.

A listed bank may notify stock exchanges about a major cyberattack because investors need material information about events affecting the company. SBI said the incident was not expected to affect its operations or financial performance, making that assessment part of its market communication. The filing also created a public record of the breach.

Customers have a different need. They may need to recognise suspicious calls, emails or messages after names and contact details are exposed. Direct notice can explain which information was leaked and what steps customers should take. The Internet Freedom Foundation flagged that SBI had informed stock exchanges but had not notified the affected customers.

The organisation also said SBI learned of the breach from external agencies after the data appeared online. It urged the bank to explain the exposure to customers. SBI has engaged an independent cybersecurity agency to investigate the nature and extent of the leak.

SBI is the affected bank and the organisation responsible for responding to the incident. It disclosed the breach to stock exchanges, assessed its likely effect on operations and finances, and engaged an independent cybersecurity agency. SBI also needs to establish what happened and how widely data was exposed.

The independent agency’s role is to assess and investigate the leak. External agencies played a different role in the reported sequence: the Internet Freedom Foundation said SBI learned of the breach from them after the data had been published online. The article does not identify those agencies or describe their exact methods.

Financial regulators set expectations and monitor risks across the banking system. The article specifically says the Reserve Bank of India has repeatedly warned lenders about cybersecurity risks that could affect financial stability. The breach’s investigation should clarify how data left SBI’s systems and what response is needed.

Cyberattacks can move personal data outside an organisation when attackers gain unauthorised access and copy files, exploit a software weakness, steal login credentials or misuse an account. Data can also leave through an insider or a compromised device. The article does not identify the mechanism in the SBI incident; the Internet Freedom Foundation said the bank did not yet know how the data had left its systems.

Basic safeguards include limiting access to only necessary staff, using multi-factor authentication, encrypting sensitive data and promptly fixing software weaknesses. Regular backups, employee awareness training and clear incident-response plans also help. Continuous monitoring can reveal unusual downloads or transfers before a large leak spreads.

SBI has hired an independent cybersecurity agency to determine the incident’s nature and extent. The RBI has repeatedly warned lenders about cybersecurity risks. The SBI investigation may show which controls failed and what changes are needed, but the article does not report those findings yet.