SBI Data Breach: 3,897 Customer Records Found on Dark Web
Image: Wikimedia Commons
State Bank of India has told the stock exchanges that 3,897 customer records containing personal information were found among about 3.75 lakh records circulating on the dark web. The bank said on Wednesday, October 21, that it learnt of the exposure on October 16 from its threat intelligence provider, the Defence Cyber Agency and CERT-In, and has started an investigation with an outside cybersecurity agency.
Names, Phone Numbers and Addresses Were in the Data
According to reports on the filing, the 3,897 records carry customers’ names, dates of birth, gender, registered mobile numbers, email addresses and residential addresses. They also include branch details, customer information file (CIF) identifiers, lead IDs and metadata linked to loan and lead records. The reports do not list passwords, PINs or one-time passwords among the exposed fields, and none mentions stolen money. SBI said the incident has no material impact on its core operations, financial performance or business continuity.
Details such as a name, phone number and address can still be used by fraudsters to pose as bank staff, so customers who get unexpected calls or messages about loans or accounts should check with their branch. See IPB’s earlier report on SBI’s warning about a WhatsApp scam.
Five Days From Alert to Disclosure
SBI said its preliminary analysis covered roughly 3.75 lakh records and that only 3,897 held personally identifiable information. The bank said it activated its cyber incident response and containment protocols once the alerts arrived on October 16. It has engaged an independent agency empanelled by CERT-In, the government’s cyber emergency response team, for a full assessment, and said remedial and preventive steps are being put in place.
The filing does not say how the data got out or who posted it. Reports say the investigation will test whether the data is genuine, how complete it is and where it came from.
Source of the Leak Still Unknown
The result of the CERT-In-empanelled agency’s assessment will decide whether the 3,897 figure changes and whether more customers are told. SBI has not given a date for that report. For more updates, see the Daily Updates section.
Source: Based on reporting by The Tribune (ANI) and Cyber Security News, both citing SBI’s stock exchange filing.
Image: Wikimedia Commons.
