State Bank of India has confirmed a data leak affecting 3,897 customer records containing personal information, discovered within a set of roughly 375,000 records circulating on the dark web. The state-owned lender, India's largest bank, disclosed the incident in a stock-exchange filing dated October 21, saying it "has experienced an incident involving the loss of certain data." The bank has not yet determined where the data originated, whether all of it is genuine, or what threat it poses to affected customers.
The compromised information reportedly included customers' registered mobile numbers, birthdates, names, gender, email addresses, home addresses, branch and CIF identifiers, lead IDs, and metadata tied to loan or lead records and related files, according to the filing. A CIF identifier is the customer information file number, the bank's internal ID for each account holder. The bank hasn't clarified whether the 3,897 records correspond to 3,897 distinct individuals or what the remaining portion of the dataset contains—the confirmed records represent roughly 1 in 100 of those the bank reviewed. Account numbers, balances, passwords, one-time passcodes, card details, and government identity numbers such as PAN or Aadhaar were not listed among the exposed categories.
The bank received the alert on October 16 through its threat intelligence provider, CERT-In—India's national computer emergency response team—and the Defense Cyber Agency, the armed forces' cyber unit under the Ministry of Defense. The bank activated its incident response and containment procedures and brought in an independent cybersecurity firm from CERT-In's panel of approved security auditors to evaluate what the filing calls "the alleged compromise." The incident has no material impact on the bank's core business operations, financial performance, or business continuity, the filing states—language that covers the bank's business, not its customers. The filing doesn't name an attacker, forum, or dataset, and it doesn't mention whether affected customers have been or will be notified.
The danger in the exposed categories is impersonation: a phone call or message that deploys a customer's name, mobile number, birthdate, address, branch, and internal ID to seem like it's coming from the bank itself, the report explains. The figure of approximately 375,000 records matches a claim flagged by the monitoring account CyberPulse56 on X on October 16, which said a threat actor using the name Siriusim claimed to have leaked customer documents and personal data linked to SBI—375,000 rows in CSV format and 2,722 PDF documents, including personal information, loan applications and supporting documents, account-opening forms, and addresses. The Free Press Journal examined the listing on BreachForums, a cybercrime forum used to trade stolen data, and found four sample records posted with the listing; the phone numbers in the samples were valid, and the WhatsApp profile picture on one number matched the passport-size photograph on that person's KYC document, which the actor had also posted. That verification covers four records and doesn't prove the entire set is authentic or reveal its source—the samples were mostly loan-related and carried KYC fields, and they didn't show whether the data belonged to SBI itself, one of its subsidiaries, or a third-party provider handling banking applications. Nothing in the bank's filing connects its analysis to the listing, and the bank hasn't said whether the 2,722 PDF documents were part of what it examined. Whether any SBI system was directly breached remains an open question—the filing leaves the data's origin to the investigation and provides no date for when the data first surfaced. The bank's customers may face heightened exposure to phishing attacks and social engineering attempts that leverage the leaked personal details to build credibility, a risk that compounds when attackers can reference internal identifiers most customers wouldn't expect outsiders to know.