SBI Admits Data Leak But Doesn't Know Where It Came From
India's largest bank has confirmed that nearly 4,000 customer records appeared in a dataset of roughly 375,000 rows circulating on the dark web. State Bank of India disclosed the incident in a stock exchange filing on October 21, stating plainly that it 'has experienced an incident involving the loss of certain data.' It does not yet know whether the data is real, where it originated, or how much damage has been done.
The 3,897 records SBI has identified represent about one percent of the total dataset it examined. The exposed fields reportedly include names, dates of birth, mobile numbers, email and residential addresses, gender, branch codes, internal customer identifiers (CIF numbers), lead IDs, and loan-related metadata. The filing is careful to note that account numbers, card details, passwords, one-time passcodes, and government ID numbers such as PAN or Aadhaar are not in the listed categories.
That might sound reassuring. It isn't entirely. The combination of name, mobile number, date of birth, home address and internal bank identifiers is more than enough for convincing impersonation. A fraudster who knows your branch code and CIF number alongside your personal details can sound remarkably like your bank.
The alert came in on October 16 from CERT-In, India's national cyber emergency body, and the Defence Cyber Agency. SBI activated its incident response procedures and brought in an independent cybersecurity firm from CERT-In's approved auditor panel. The filing says there is no material impact on operations, financial performance or business continuity. That covers the bank. Whether the same is true for the affected customers is another matter entirely.
The filing names no attacker, no forum, and no specific dataset. That said, the 375,000-row figure aligns closely with a post flagged on X on October 16 by the threat monitoring account CyberPulse56. The post identified a threat actor going by the name Siriusim, who claimed to have leaked 375,000 rows of CSV data and 2,722 PDF documents belonging to SBI customers, including loan applications, KYC documents, account-opening forms and personal records.
The Free Press Journal looked at the BreachForums listing and found four sample records posted as proof. The phone numbers checked out as valid. On one of them, the WhatsApp profile picture matched the passport photo on the KYC document the actor had also posted. Four records is not a meaningful sample size, but it is not nothing either.
Crucially, even those sample checks could not establish whether the data came from SBI directly, one of its subsidiaries, or a third-party vendor involved in processing banking applications. SBI's filing does not connect its analysis to the BreachForums listing, and makes no mention of the 2,722 PDFs.
Whether any SBI system was actually breached remains an open question. The filing does not say when the data first appeared, who is responsible, or what the preliminary root cause might be. By contrast, when Bank of Baroda disclosed a nearly identical-sounding incident in July, it at least named a probable cause: business email compromise. SBI offers nothing equivalent.
There is also no mention in the filing of notifying affected customers. The bank's cyber security page, last updated in June, points people toward [email protected] and the national cybercrime helpline on 1930. That guidance predates this incident by months and tells you nothing about what SBI plans to do for the people whose data may already be on a criminal forum.