SBI data leak: What happened, what data was exposed and what customers should do

SBI has identified 3,897 customer records containing personal information in a dataset found on the dark web. The bank is investigating the suspected exposure, which raises concerns about targeted financial fraud and identity theft.

The State Bank of India (SBI) is investigating a suspected data leak after identifying 3,897 customer records containing personally identifiable information (PII) in a dataset available on the dark web.

In a stock exchange filing on October 21, the country’s largest public-sector lender said a preliminary analysis of approximately 3.75 lakh records had revealed the customer information. SBI received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

The bank has activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency empanelled with CERT-In to investigate the incident. The investigation aims to establish the authenticity, source and extent of the suspected exposure. SBI said the incident had no material impact on its business operations, financial performance or business continuity. Its core banking functions continue to operate normally.

What data was exposed?

According to SBI’s filing, the records reportedly contained customers’ names, gender, registered mobile numbers, dates of birth, email addresses and residential addresses. The dataset also included branch and Customer Information File (CIF) identifiers, lead IDs, loan-related metadata and information from other associated files.

The bank is still verifying the authenticity and completeness of the data and investigating its origin. The findings do not establish that all the customers concerned have suffered financial losses or that their bank accounts have been accessed.

Does the leak mean SBI accounts have been hacked?

Not necessarily. Exposure of personal information does not automatically mean that bank accounts have been compromised. SBI’s preliminary findings concern personal information and loan-related metadata. The bank has not established that account passwords, PINs, one-time passwords (OTPs) or transaction credentials were exposed.

However, the information could help fraudsters make scams more convincing. Criminals who know a customer’s name, phone number, address or loan-related details could impersonate bank officials and claim there is a problem with an account, loan application or KYC verification.

Because the caller may already know personal details, the communication could appear genuine. Customers should not treat familiarity with their information as proof of identity.

How could the data be misused?

According to Sarthak Dubey, co-founder and COO of Mitigata, customer information can be exposed through systems beyond a bank’s core banking infrastructure. Loan applications, KYC documents and account-opening forms may be stored across loan origination systems, employee email accounts, shared drives and third-party platforms used by vendors. Potential entry points include compromised employee or vendor credentials, phishing, infostealer malware and misconfigured storage systems or application programming interfaces (APIs).

Dubey cautioned that investigators must establish whether the information originated from SBI’s systems, a third-party service provider or another source before drawing conclusions.

The key concern is that exposed personal information could be used to make fraudulent calls, messages and emails appear legitimate, increasing the risk of phishing, identity theft and financial fraud.

What should SBI customers do?

SBI customers do not need to panic or automatically close their accounts. They should, however, remain alert to unexpected calls, messages and emails involving banking, loans or identity verification.

Never share an OTP, PIN or password with anyone, even if the person claims to represent SBI. Avoid clicking on unfamiliar links or installing applications at the request of an unsolicited caller. Verify suspicious communications independently through SBI’s official website, mobile application or verified customer-service channels.

Customers should also keep transaction alerts enabled, review account activity regularly and report unauthorised transactions immediately. Checking credit reports for unfamiliar loans, credit cards or credit enquiries can help identify potential misuse of personal information. Those who do not require Aadhaar biometric authentication may also consider locking their biometrics through official UIDAI channels.

Anyone who suspects financial fraud should contact their bank immediately or call India’s cybercrime helpline at 1930.

What happens next?

SBI’s investigation must establish the source and authenticity of the data, identify any affected systems or third-party providers and determine the number of customers potentially affected. The bank will also need to secure any vulnerabilities, review access controls and strengthen monitoring for attempts to misuse the information.

Identifying potentially affected customers and communicating verified findings will be important in limiting the risk of follow-on fraud.

SBI has stated that the suspected exposure has not materially affected its operations, financial performance or business continuity. The bank said it would take appropriate remedial and preventive measures in line with applicable regulatory requirements.

The investigation is ongoing, and the full source and extent of the suspected exposure remain unclear.

The bottom line

The identification of 3,897 customer records containing personal information does not, by itself, mean that bank accounts have been hacked or money stolen. Until SBI establishes the full facts, customers should protect their banking credentials, independently verify suspicious communications and report suspected fraud promptly.

ABOUT THE AUTHOR

Dr. Muchukota Suresh Babu