SBI probes suspected dark web exposure of 3,897 customer records

New Delhi: The country's largest bank, SBI, on Wednesday said it is investigating the suspected exposure of 3,897 customer records containing personally identifiable information on the dark web, following alerts it received on October 16 from its threat intelligence service provider, the Defence Cyber Agency, and CERT-In.

A preliminary analysis of around 3.75 lakh records available on the dark web identified 3,897 customer records containing sensitive information, including registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses, State Bank of India (SBI) said in the regulatory filing on Wednesday.

The exposed information reportedly also included branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and other related files. It said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.

SBI said it had promptly activated its cyber incident response and containment protocols. It had also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the alleged compromise.

The incident has had no material impact on the bank's core business operations, financial performance or business continuity, the filing said, adding that its core business functions continued to operate normally without disruption.

A detailed assessment is underway, and the bank is implementing appropriate remedial and preventive measures, it said.

ABOUT THE AUTHOR

The Hans India