Summary Points
- SBI identified 3,897 potentially exposed customer records among roughly 375,000 records found on the dark web; authenticity and source remain unconfirmed.
- Reported data includes names, contact details, addresses, customer IDs and loan-related metadata—not account credentials, card details or government ID numbers.
- The leak could enable convincing impersonation scams; samples of four records appeared genuine, but they don’t verify the full dataset.
- SBI has launched an investigation with a cybersecurity firm; it says operations are unaffected, but has not said whether customers will be notified.
SBI finds thousands of customer records in an online leak
State Bank of India says it found 3,897 records containing customer information in a larger set of about 375,000 records circulating on the dark web. In a stock-exchange filing dated October 21, the bank confirmed a data incident but said it had not established where the information came from or whether all the records were genuine.
The exposed details reportedly include names, phone numbers, dates of birth, email and home addresses, branch details, and internal customer identifiers. The filing does not list account numbers, balances, passwords, card details, or government identity numbers among the exposed information. However, personal details can help scammers pose as bank staff in calls or messages.
SBI says India’s national cyber response team and the Defense Cyber Agency alerted it on October 16. The bank has started its response procedures and hired an independent cybersecurity firm to investigate. It says the incident has not affected its core operations, but that does not determine the risk to customers.
Source and customer impact remain unclear
The bank has not confirmed whether the records came from its own systems, a subsidiary, or an outside service provider. It also has not said whether the 3,897 records represent 3,897 individual customers or whether it will contact people who may be affected.
A cybercrime forum listing reportedly offered a much larger collection of files. A news outlet checked four sample records and found that their phone numbers worked, but those samples do not prove that the full collection is genuine or linked to SBI. The bank has not confirmed that the files in the listing match the data it reviewed.
For customers, the practical concern is targeted fraud: a convincing message may use real personal details to build trust. Customers should avoid sharing passwords or one-time codes with callers and should contact SBI through its official channels if they suspect fraud. SBI’s website also advises customers to report cyber incidents to report.phishing@sbi.co.in or India’s cybercrime helpline at 1930.
Stay Ahead with the Latest Tech Trends
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
DataProtection-V1
