State Bank of India, the country's largest lender, is investigating a data security incident after a review of records found on the dark web identified personal information belonging to 3,897 customers. Here’s what we know about what happened.
What Exactly Happened?
State Bank
of India has confirmed it is investigating a data security incident after personal information connected to its customers appeared on the dark web. On October 16, the bank was alerted by its threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) about a potential data exposure. Following these alerts, SBI initiated a preliminary review of a dataset containing approximately 375,000 records that were circulating online. In its initial analysis, the bank identified 3,897 records that contained genuine customer Personally Identifiable Information (PII). The bank has stated that it has activated its incident response protocols and has appointed an independent cybersecurity agency, empanelled by CERT-In, to conduct a full investigation into the source and scope of the exposure.
What Kind of Data Was Exposed?
The information found within the 3,897 records is significant, though it does not appear to include financial credentials that would allow for direct theft. According to SBI's regulatory filings, the exposed data includes customer names, registered mobile numbers, dates of birth, gender, email addresses, and residential addresses. Additionally, the records contained internal banking identifiers such as branch details, Customer Information File (CIF) numbers, and metadata related to loan applications and customer leads. The bank has stressed that core banking details like account numbers, balances, passwords, PINs, or OTPs were not part of this exposed dataset. The primary risk from this type of data is not the immediate loss of funds, but rather sophisticated impersonation and fraud attempts.
SBI's Official Response
In a statement to the stock exchanges, SBI confirmed the incident but maintained that it has had no material impact on its core business operations, financial performance, or business continuity. Following some initial criticism for not immediately notifying customers, the bank announced on October 23 that it had individually informed all affected individuals via email and WhatsApp. In its communications, SBI reassured customers that their account balances and funds remain safe. The bank is continuing its detailed investigation to verify the authenticity of the entire dataset found online, determine the source of the leak, and assess the full potential risk to its customers.
The Real Risk: Phishing and Fraud
While SBI has confirmed that account balances are secure, the exposure of personal and loan-related data creates a significant risk of targeted fraud. Cybersecurity experts warn that scammers can use this detailed information—like your name, address, date of birth, and loan history—to create highly convincing phishing attacks. A fraudster posing as a bank employee can sound much more credible if they already know personal details that a customer might assume only the bank possesses. This can trick individuals into revealing sensitive information like passwords, PINs, or OTPs, which could then be used to gain unauthorised access to accounts. The danger lies in the convincing nature of scams built on this leaked data.
How to Protect Your Account
Even if you were not among the customers notified by SBI, this incident is a critical reminder for all banking customers to practice strong digital hygiene. Be extremely cautious of any unsolicited calls, emails, or text messages claiming to be from your bank, even if the sender knows some of your personal details. Never share your OTP, PIN, CVV, or passwords with anyone under any circumstances. Banks will never ask for this information. It is also wise to regularly review your account statements for any unusual activity. For added security, enable two-factor or multi-factor authentication on all your financial accounts. If you receive a suspicious communication, do not click on any links or respond. Instead, contact your bank directly through its official phone number or website to verify the message.
