The State Bank of India (SBI) has issued a fresh statement on X following a recent cyber incident involving a suspected leak of customer data. The bank has reassured its customers that their account balances remain completely safe, saying the incident affected a “very very small number” of customers.
It added that it is taking all possible steps to protect customers’ interests.In a fresh post on X, the public sector bank said the incident had no material impact on its IT systems, core business operations, financial performance or business continuity. “We reiterate that safety of our customers' financial assets, data and their trust in us remain our highest priorities,” the bank said.The statement comes a day after SBI disclosed that a preliminary analysis had identified 3,897 customer records containing personal information among data found on the dark web.What happened with SBI data?In a regulatory filing on Wednesday, SBI revealed that a preliminary analysis had identified 3,897 customer records containing personally identifiable information among around 3.75 lakh records found on the dark web. The bank said it received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).What data of SBI customers was leaked?The data leak reportedly exposed includes customers’ names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses.
The records also contain branch details, customer information file (CIF) identifiers, lead IDs and metadata linked to loan and lead records. However, SBI has sought to reassure customers that their money remains safe.
In its latest post on X, the bank said, “Customer balances are completely safe,” adding that it was taking all possible steps to protect customers’ interests.While SBI has assured customers that their balances are safe, the investigation into the exposed records is still underway. According to the bank, a detailed investigation is needed to establish the authenticity and completeness of the exposed data, identify its source and determine the extent of the incident.Who leaked customer data of SBI data?The incident came to public attention after an anonymous hacker group called Siriusim reportedly claimed on the dark web forum BreachForums that it had obtained information relating to around 3.75 lakh SBI customer records.The group claimed to possess more than 3.75 lakh rows of data in CSV format and 2,722 PDF files, including personal information and loan-related documents.
However, the full extent and authenticity of the material have not been independently established.SBI has not publicly identified the source of the suspected exposure or named the group responsible. The bank said it was monitoring the situation and would take appropriate measures in line with applicable regulatory requirements as its investigation progresses.- Ends