State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.
The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain data." The count is preliminary, and the bank has yet to establish whether the data is authentic, how far the exposure goes and what risk it poses to customers.
The exposed information "reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files," in the filing's words. A CIF identifier is the customer information file number, the bank's internal ID for each customer.
The bank has not said whether the 3,897 records belong to 3,897 different people, or what the rest of the set contains. The 3,897 are roughly 1 in 100 of the records it examined.
Account numbers, balances, passwords, one-time passcodes, card details and government identity numbers such as PAN or Aadhaar are not among the categories the filing lists. The risk in the listed categories is impersonation: a caller or message that uses a customer's name, mobile number, date of birth, address, branch, and internal ID to appear to come from the bank.
The alert reached the bank on October 16 via its threat intelligence provider, CERT-In, India's national computer emergency response team, and the Defense Cyber Agency, the armed forces' cyber agency under the Ministry of Defense.
The bank activated its incident response and containment procedures and engaged an independent cybersecurity firm from CERT-In's panel of approved security auditors to assess what the filing calls "the alleged compromise."
The incident has no material impact on the bank's core business operations, financial performance or business continuity, the filing says. That covers the bank's business, not its customers.
The filing names no attacker, forum or dataset. The figure of about 375,000 matches a claim that the monitoring account CyberPulse56 flagged on X on October 16.
The account said a threat actor using the name Siriusim claimed to have leaked customer documents and personal data linked to SBI: 375,000 rows in CSV format and 2,722 PDF documents, said to include personal information, loan applications and supporting documents, account-opening forms and addresses.
The Free Press Journal examined the listing on BreachForums, a cybercrime forum used to trade stolen data, and found 4 sample records posted with the listing. The phone numbers in the samples were valid. The WhatsApp profile picture on one number matched the passport-size photograph on that person's KYC document, which the actor had also posted.
That check covers 4 records and does not show that the whole set is genuine or where it came from. The samples were mostly loan-related and carried KYC fields, and they did not show whether the data belonged to SBI itself, one of its subsidiaries, or a third-party provider that handles banking applications.
Nothing in the bank's filing ties its analysis to the listing, and the bank has not said whether the 2,722 PDF documents were part of what it examined.
Whether any SBI system was breached is an open question. The filing leaves the source of the data to the investigation and gives no date for when the data first appeared.
The filing does not mention whether affected customers have been or will be told. The bank's cyber security page, last updated in June, tells customers to report any cyber incident to [email protected] or the national cybercrime helpline, 1930. That is general advice, written before the incident.
Bank of Baroda, another state-owned bank, told the exchanges on July 27 about a cyber-security incident in nearly the same words, including "the alleged compromise," after receiving "a communication from an anonymous source claiming access to certain data." That filing named a preliminary cause, "potential business email compromise." SBI's names none.