State Bank of India (SBI), the nation’s largest public sector bank, is currently examining a concerning data breach after discovering that 3,897 customer records have surfaced on the dark web. This revelation was made in a stock exchange filing dated October 21, indicating a potential compromise of personal information from a dataset comprising 375,000 records. The origins of this data remain unclear at this stage.
Details of the Data Exposure
The leaked information reportedly encompasses a wide range of personal data, including customers’ mobile numbers, birth dates, names, gender, email addresses, residential addresses, and unique identifiers such as CIF numbers. CIF, or Customer Information File, is an internal identification system used by the bank for each customer. Despite the apparent exposure, sensitive details such as account numbers, balances, passwords, and government ID numbers like PAN or Aadhaar are not included in the disclosed categories.
The potential risk primarily involves identity impersonation, where malicious actors might use personal information to deceive customers by posing as bank representatives. This development has raised concerns about the safety of customer data and the possibility of further exploitation.
Response and Investigation
Upon receiving an alert from CERT-In and the Defense Cyber Agency on October 16, SBI promptly initiated its incident response protocols. The bank has engaged a cybersecurity firm from CERT-In’s panel to conduct a thorough assessment of the situation and determine the legitimacy of the alleged compromise. No significant impact on the bank’s core operations or financial performance has been reported, though the implications for customers remain under scrutiny.
While the bank has not officially linked the data to any specific breach or attacker, reports surfaced from CyberPulse56, a monitoring account that highlighted a claim by a threat actor named Siriusim. This individual allegedly leaked 375,000 rows of customer data, including personal and loan-related documents, on a cybercrime forum known as BreachForums.
Ongoing Concerns and Outlook
The veracity of the leaked data is still being evaluated, with only a few sample records examined to date. These samples predominantly pertain to loan applications and KYC details, without clear evidence of their connection to SBI, its subsidiaries, or any third-party services associated with the bank. The investigation is ongoing to determine the breach’s origin and scope.
SBI has not disclosed whether it has notified affected customers about the potential breach. The bank continues to advise vigilance against cyber threats and encourages customers to report suspicious activities through designated channels. As the investigation unfolds, SBI remains committed to safeguarding customer data and enhancing cybersecurity measures to prevent future incidents.
