CPI(M) MP seeks independent probe into SBI customer data exposure, writes to FM Nirmala Sitharaman

The reported exposure involved 3,897 SBI customer records found within a much larger collection on the dark web. The records reportedly included names, contact details, addresses, identifiers, and loan-related metadata. The incident mattered because customers’ personal information may have been exposed even though SBI’s core banking operations continued normally.

A. A. Rahim wrote to Union finance minister Nirmala Sitharaman on October 21. He asked for an independent investigation with clear timelines to find the source and extent of the suspected breach. He also urged SBI to contact affected customers directly and provide accessible channels for reporting suspected fraud.

Rahim said public-sector banks must protect information entrusted to them. He warned that exposed data could enable identity theft, targeted phishing, impersonation, and financial fraud. He also called for urgent protection for customers and strict accountability for security failures. The article does not report the investigation’s outcome.

The dark web is a part of the internet designed to hide websites, services, or users’ locations. It is not normally listed by ordinary search engines. Access often requires special software or network settings. That hidden design can support privacy, but it can also provide a marketplace or meeting place for unlawful activity.

The ordinary internet includes familiar websites, news pages, apps, and online banking services. People usually reach them through standard browsers and search engines. Their addresses and content are generally easier to find. The dark web is less visible, so data placed there may be harder for affected people to discover directly.

In this case, SBI customer records were identified in a larger trove on the dark web. The article reports that threat intelligence sources, the Defence Cyber Agency, and CERT-In helped SBI learn about the incident. The article does not explain how the records reached the dark web or who posted them.

The reported exposure involved 3,897 SBI customer records containing personal information. These records were identified within a much larger collection found on the dark web. The scale matters because the exposed SBI records were only one part of a broader trove containing about 3.75 lakh records.

SBI informed the Bombay Stock Exchange and the National Stock Exchange about an incident involving the loss of certain data on October 21. The bank identified the 3,897 customer records in the larger collection. The article does not say that every record in the 3.75 lakh collection belonged to SBI or describe the other records.

SBI said it learnt about the incident on October 16 through its threat intelligence provider, the Defence Cyber Agency, and CERT-In. The figures show both the specific number linked to SBI and the wider scale of material found online. The article does not report any later change to those numbers.

The reported records contained enough personal and banking-related information to raise serious privacy concerns. Listed details included registered mobile numbers, dates of birth, names, gender, email addresses, and residential addresses. The records also reportedly carried branch and Customer Information File, or CIF, identifiers.

The collection included lead IDs and metadata linked to loan records and other files. These details can connect a person’s identity and contact information with banking relationships or loan-related records. That combination is more revealing than a single isolated detail. The article does not say that passwords, account balances, or transaction records were exposed.

SBI described the event as involving the loss of certain data and said its core operations remained unaffected. However, Rahim stressed that uninterrupted services do not remove the seriousness of personal-information exposure. He urged direct notification and support so affected customers could report suspected fraud and receive assistance.

Exposed personal information can give criminals material for identity theft and impersonation. They may use a person’s name, date of birth, phone number, email address, or residential address to appear credible. The article specifically warns of targeted phishing and financial fraud, although it does not report that such crimes have already occurred.

For example, a fraudulent caller could use known customer details and banking-related information to make a scam message seem genuine. A targeted email or call might pressure someone to reveal more information or take an unsafe action. The article does not describe a confirmed attack, so these are risks Rahim identified rather than reported outcomes.

Rahim said customers should not be left exposed without timely information and institutional support. He urged SBI to notify affected people directly and offer accessible channels for reporting suspected fraud. He also asked the Centre to take urgent protective measures for those at risk.

SBI was the affected bank and informed the Bombay Stock Exchange and National Stock Exchange on October 21. It said it learnt about the incident on October 16 through its threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team, or CERT-In. The article does not state that these bodies completed a formal investigation.

The threat intelligence provider, Defence Cyber Agency, and CERT-In were the sources through which SBI learned about the incident. SBI’s stated role was to report the data-loss incident and address customer risks. Rahim’s letter asked the finance ministry to ensure a comprehensive, independent investigation with clear timelines and to require direct notification of affected customers.

The finance ministry therefore became the focus of a request for oversight and urgent protective action. Rahim also sought strict accountability for security lapses. The article does not describe a final government decision, identify the data’s source, or report the investigation’s results.

Core operations concern whether banking services continue to function. Data security concerns whether customers’ personal information remains protected. These are separate issues. A bank may avoid service disruption while still suffering a serious security failure if names, contact details, addresses, identifiers, or loan-related information are exposed.

The SBI incident illustrates this distinction. SBI said its core operations remained unaffected, but the reported records included registered mobile numbers, dates of birth, email addresses, residential addresses, branch details, CIF identifiers, and loan metadata. Such information could help enable identity theft, targeted phishing, impersonation, or financial fraud.

Rahim therefore argued that uninterrupted services did not reduce the incident’s seriousness. He sought an independent investigation, direct notification, accessible fraud-reporting channels, assistance for people at risk, and accountability for lapses. The article presents these as requested next steps, not confirmed outcomes.