Fast Facts
- SBI customer data surfaced on the dark web: 3,897 identified records exposed contact, identity, address, branch and loan-related details.
- Recurring breach routes include compromised credentials, exposed third-party servers and cryptographic vulnerabilities.
- Breaches may evade internal detection: external threat-intelligence providers and agencies flagged the SBI incident.
1. Threat, Techniques, and Targets
State Bank of India (SBI) reported that its preliminary analysis identified 3,897 customer records with personal information among about 375,000 records found on the dark web. The exposed data reportedly included names, contact details, dates of birth, addresses, branch details, customer identifiers, and loan or lead metadata.
The report does not identify the attack method or the responsible threat actor. However, earlier incidents involving other organizations included compromised credentials, third party server exposure, and cryptographic vulnerabilities affecting digital certificates. The known targets include SBI customers and, in past incidents, customers or systems linked to Bank of Baroda, Reliance Group, and eMudra Ltd.
2. Impact, Security Implications, and Remediation
The exposed records create privacy and data protection concerns. However, SBI said the incident had no material impact on its core operations, financial performance, or business continuity. The incident also highlights potential obligations under India’s Digital Personal Data Protection Act and Rules. The source states that compliance obligations take effect on 13 May 2027 and that violations may lead to civil penalties of up to Rs. 250 crore, depending on severity.
SBI activated its incident response protocols and appointed an independent cybersecurity agency to investigate. In addition, organizations should conduct Data Protection Impact Assessments, appoint Data Protection Officers, and set up automated incident reporting to CERT-In, the Data Protection Board of India, and affected individuals, as applicable. They should also securely retain server, VPN, firewall, and Active Directory logs for 180 days to support investigations and meet CERT-In requirements.
Discover More Technology Insights
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
