SBI Says 3,897 Customer Records With Personal Data Found in 375,000-Record Dark Web Dump

State Bank of India, the country's largest lender, acknowledged Wednesday, Oct. 21, that customer data tied to it is circulating on the dark web. In an exchange filing, the bank said a preliminary review of about 375,000 records found 3,897 customer records containing personally identifiable information.

The bank has not said what the remaining records contain.

What the bank disclosed

SBI said it received communications from its threat intelligence service provider, the Defence Cyber Agency and CERT-In, India's national cyber emergency team. The alerts flagged suspected exposure of customer data earlier in the week.

According to the filing, the exposed information includes:

• Registered mobile numbers
• Dates of birth
• Names and gender
• Email addresses
• Residential addresses
• Branch and CIF identifiers
• Lead IDs and metadata tied to loan and lead records

SBI said it activated its cyber incident response and containment protocols. It has also hired an independent CERT-In-empanelled cybersecurity agency to assess the incident.

The bank said the investigation will establish the authenticity and completeness of the exposed data, determine its likely source and extent, and assess the risks. SBI also said the incident has no material impact on its core business operations, financial performance or business continuity. Core functions are running normally, it said, and remedial and preventive measures are being put in place.

The claim that started it

The public trail begins on Oct. 16. The cybersecurity monitoring account CyberPulse56 flagged a post by a group calling itself Siriusim. The group claimed to hold about 375,000 entries in CSV format plus 2,722 PDF documents linked to SBI. It described the material as its "first disclosure" of the dataset.

CyberPulse56 said the data included customer personal information, addresses, loan applications and supporting documents. India Today reported that Siriusim posted the claim on BreachForums with four sample customer records. That report said the material may include KYC records and Aadhaar numbers. Those were claims about the posted material, not findings.

SBI's filing does not mention Aadhaar numbers or account-opening documents. It lists the fields above. Whether the larger set of PDFs holds more sensitive material is not addressed in the filing.

The gap between the claim and the confirmation

The hacker group's framing is a large-scale theft of SBI customer data. The bank's account is narrower: a preliminary review that found personal data in 3,897 records, no impact on operations, and an investigation to determine whether the dataset is authentic and complete.

Row counts also say little about people affected. As CyberPulse56 noted, multiple entries can relate to one person, so 375,000 rows does not equal 375,000 customers. The same caution applies to the 2,722 PDFs.

It is also unclear whether the material is new or recycled from earlier leaks. India Today raised that question on Oct. 19. At that point SBI had not addressed the claims, and the Economic Times reported on Oct. 20 that SBI had not responded to its request for comment. The bank's filing came the following day.

SBI has not said how the data left its control, or whether it came from its own systems, a subsidiary or a third-party vendor handling loan leads. The presence of lead IDs and loan-lead metadata in the exposed fields points toward application and lead records rather than core account data, but the bank has not drawn that conclusion itself.

Context: a rough month for Indian finance

The claim lands during a stretch of cyber trouble for the sector. Earlier this month, cyberattacks hit around 20 banks, non-bank lenders and fintech firms. The Economic Times reported that attackers allegedly used stolen credentials and flaws in payment application programming interfaces. No source has linked that wave to the SBI dataset.

The Reserve Bank of India tightened cybersecurity requirements for commercial banks earlier this year.

Market reaction and what comes next

SBI shares traded flat near Rs 970 at around 10 a.m. Wednesday on the BSE, according to exchange data. The stock's 52-week range runs from Rs 891.55 to Rs 1,234.80, and it is down 12% over one year.

The bank reports second-quarter results on Nov. 5.

For customers, the practical risk is the one CyberPulse56 laid out: if the data is genuine, names, phone numbers, addresses and loan-lead details can make phishing calls and fake loan applications look convincing. The usual advice applies. Verify unexpected bank messages through official channels, and never share passwords, PINs or one-time passwords.

The open questions are all in the hands of the CERT-In-empanelled investigators. They must determine whether the remaining records are real, how many unique customers are involved, and who held the data when it leaked. SBI has not said when the assessment will conclude or whether it will notify customers directly.