State Bank of India has confirmed that 3,897 customer records containing personal information were found in a dataset of about 375,000 records on the dark web. In a stock-exchange filing dated October 21, the bank acknowledged an incident involving the loss of certain data, but called the count preliminary. It has not yet established whether the data is authentic, how far the exposure goes, or what risk it poses to customers.
The exposed information reportedly includes customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records. The filing does not list account numbers, balances, passwords, one-time passcodes, card details, or government identity numbers such as PAN or Aadhaar. The main risk in the listed categories is impersonation: a caller or message could use a customer's name, mobile number, date of birth, address, branch, and internal ID to appear to come from the bank.
According to the filing, the alert reached the bank on October 16 via its threat intelligence provider, CERT-In, and the Defense Cyber Agency. The bank activated its incident response and containment procedures and engaged an independent cybersecurity firm from CERT-In's panel of approved security auditors to assess what it called an alleged compromise. The filing says the incident has no material impact on the bank's core business operations, financial performance, or business continuity.
The filing names no attacker, forum, or dataset. A monitoring account on X, CyberPulse56, had flagged the same day that a threat actor using the name Siriusim claimed to have leaked SBI-related data: 375,000 rows in CSV format and 2,722 PDF documents. The Free Press Journal examined the listing on BreachForums and found four sample records with valid phone numbers; one WhatsApp profile picture matched the passport-size photo on that person's KYC document. That check covers only four records and does not show that the whole set is genuine or where it came from. The bank's filing does not tie its analysis to that listing, and it has not said whether the PDFs were part of what it examined. Whether any SBI system was breached remains an open question.