State Bank of India confirms leak after 3,897 customer records found on dark web

State Bank of India (SBI), the country's largest lender, has confirmed that customer personal data appeared in a dataset being offered on the dark web, The Hacker News reported on October 21. In a stock-exchange filing the same day, the bank said it "has experienced an incident involving the loss of certain data" and that it had identified 3,897 customer records within a set of roughly 375,000 records, while the origin of the data is still unknown.

What happened

According to The Hacker News, the monitoring account CyberPulse56 flagged the claim on X on October 16. A threat actor using the name "Siriusim" allegedly offered around 375,000 CSV rows and 2,722 PDF documents linked to SBI on the BreachForums cybercrime forum. The bank said in its filing that CERT-In, India's national computer emergency response team, and the Defence Cyber Agency alerted it on October 16, after which it activated its incident response process and engaged an independent firm from CERT-In's empanelled auditor list.

The Hacker News noted that the 3,897 figure is preliminary. SBI has not confirmed whether the wider dataset is authentic, whether its own systems were breached, or whether the records belong to 3,897 separate individuals. The filing does not name a cause.

What data is involved

The bank's filing lists registered mobile numbers, dates of birth, names, gender, email and residential addresses, branch and CIF customer identifiers, lead IDs and loan-related metadata. According to the report, the filing does not mention account numbers, balances, passwords, one-time passwords, card details, or PAN and Aadhaar numbers. SBI said the incident has no material impact on its operations or finances; The Hacker News pointed out that this assessment refers to the bank rather than to affected customers.

The Free Press Journal had earlier reviewed four sample records from the listing and found the phone numbers active, with one WhatsApp profile photo matching a KYC document photo, The Hacker News said. That small sample does not verify the full dataset or how it was obtained.

Who is affected

The main risk for affected customers is impersonation: scam calls or messages that use accurate personal and loan details to appear to come from the bank. It remains unclear whether SBI will notify individual customers, as the filing does not address notification. The Hacker News compared the case to a similar filing by Bank of Baroda on July 27, which cited a potential business email compromise as the preliminary cause.

What to do

SBI customers should treat unsolicited calls, SMS and emails referencing their accounts or loans with caution, even when the caller knows personal details, and should never share OTPs, PINs or passwords. Suspicious contact should be verified through the bank's official channels. Organizations in the financial sector should review third-party and lead-management systems that hold customer and loan metadata, since such data is frequently used in targeted fraud.