State Bank of India Investigates Suspected Customer Data Leak

State Bank of India (SBI), the country’s largest lender by assets, has launched an investigation after thousands of customer records containing personal information were identified on the dark web.

In an October 21 stock exchange filing, SBI said a preliminary examination of approximately 375,000 records had identified 3,897 customer records containing personally identifiable information. The reportedly exposed details included names, mobile numbers, dates of birth, email addresses, residential addresses, branch and customer identifiers, and metadata associated with loan records.

The bank received alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). It activated incident response and containment procedures and appointed an independent cybersecurity agency approved by CERT-In to investigate.

SBI said further investigation was needed to establish the data’s authenticity, identify its source, and assess the risks to customers and the bank. It reported no material impact on its operations, financial performance, or business continuity.

If authentic, the exposed information could help fraudsters impersonate bank employees and make phishing messages or calls more convincing. Criminals can use breached data to create apparently legitimate messages and solicit sensitive information, including banking details and passwords.