State Bank of India (SBI) on Wednesday informed the stock exchanges that it had experienced "an incident involving the loss of certain data", confirming that customer records were exposed on the dark web. In a disclosure under Regulation 30 of SEBI's listing rules, the bank said a preliminary analysis had identified 3,897 customer records containing personally identifiable information (PII). The bank said it was alerted to the suspected exposure on October 16 by its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In, the Indian Computer Emergency Response Team.
SBI Data Breach: What the Filing Says About the Exposed Data
According to the filing, the bank analysed about 3,75,000 records available on the dark web, of which 3,897 were found to contain personally identifiable information. The information reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses.
The filing adds that the data also contained branch and CIF (Customer Information File) identifiers, lead IDs, and metadata associated with loan and lead records and other related files. "A detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank," the bank said.
SBI Says Core Banking and Operations Are Unaffected
The bank stated that the incident has not affected its core operations. "We wish to submit that this does not have any material impact on Bank's Core business operations, financial performance or business continuity. The Bank's core business functions continue to operate normally without disruptions," the filing said.
SBI said it had promptly activated its cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to assess the nature and extent of the alleged compromise. "A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required," the bank said, adding that it continues to monitor the situation and will take action in accordance with regulatory requirements.
The Hacker Claim Came Before the Disclosure
Before the bank's disclosure, a hacker group calling itself Siriusim had claimed on the dark-web forum BreachForums that it had obtained information relating to 3.75 lakh SBI customers. SBI has not named any group in its filing, and the claim has not been independently verified.
The disclosure comes at a time of heightened regulatory focus on cybersecurity in the banking sector. In July, Bank of Baroda acknowledged a data leak that reportedly exposed 1TB of customer data.
