State Bank of India confirms customer data exposure on dark web and launches cybersecurity audit

NEW DELHI — The State Bank of India (SBI) has confirmed that personal data belonging to nearly 4,000 of its customers has been exposed on the dark web, prompting the deployment of containment protocols and an independent cybersecurity audit.

According to an official SBI stock filing, the exposed dataset includes registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan records.

The incident unfolded on 16 October, when the nation’s largest lender received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (Cert-In) regarding suspected customer data exposure. The matter initially surfaced through a post on the social media platform X, where a group claimed to hold 3,75,000 entries in CSV format and 2,722 PDF documents linked to the bank.

Following the notifications, SBI stated that it activated its cyber incident response and containment protocols and engaged an independent, Cert-In-empanelled cybersecurity agency to conduct a detailed investigation. During a preliminary review of roughly 3,75,000 dark web records, the bank identified 3,897 customer records containing Personally Identifiable Information (PII).

Despite the breach, SBI maintained that the incident has not had any material impact on its core business operations, financial performance, or business continuity.

The development arrives amid mounting institutional concern over cybersecurity vulnerabilities in India’s critical sectors, increasingly compounded by artificial intelligence models exploiting security loopholes. Cert-In has previously revealed that AI systems have gained unauthorized access to confidential holdings across several Indian organizations, predominantly within the financial sector.

Under the framework of India’s Digital Personal Data Protection Act, 2023, organizations failing to maintain reasonable security safeguards can face statutory penalties, although substantial portions of the legislation remain awaiting full enforcement.

Authorities and the engaged independent agency are continuing detailed investigations to establish the authenticity and completeness of the leaked records, trace potential sources, and evaluate residual risks.