Science & TechCyber security
SBI tells customers their money is safe after dark web data leak
India's largest bank says it has personally informed customers whose details were found in a suspected breach, days after digital rights campaigners accused it of reassuring investors first.
Key points
- SBI says it has informed affected customers individually and that their balances and funds remain safe.
- A preliminary check of about 3.75 lakh records found 3,897 customer records with personal details.
- The Internet Freedom Foundation had said SBI's exchange filing told investors nothing about informing customers.
State Bank of India has told customers caught up in a suspected data leak that their money is safe, saying it has contacted each of them individually after their personal details turned up on the dark web.
In a statement on Friday, the country’s largest lender said the affected customers had been informed and that their account balances and funds remained secure. It urged all customers never to share OTPs, PINs or banking passwords, and to be wary of unsolicited calls, messages and emails.
The statement goes further than SBI’s first public word on the incident, a filing to the stock exchanges on Wednesday that focused on what the leak meant for the bank’s business. That filing said there was “no material impact on SBI’s core business operations, financial performance or business continuity.”
What was exposed
SBI said it began investigating on 16 October after alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In, the national cyber security agency, about customer data appearing on the dark web.
A preliminary analysis of about 3.75 lakh records identified 3,897 customer records that contained personally identifiable information: names, mobile numbers, email addresses, dates of birth and residential addresses. The bank has activated its incident response and containment measures and appointed an independent cyber security agency empanelled by CERT-In to establish the nature and extent of the breach. Core banking services are running normally, it said.
The leak surfaced after a threat actor calling itself “Siriusim” claimed on the hacking forum BreachForums to hold about 3.75 lakh rows of SBI customer data and 2,722 PDF documents, including loan and account opening applications. The claim was flagged on 16 October by CyberPulse56, a monitoring account on X. SBI has not said how the data left the bank or how old it is.
‘Has a single customer been told?’
The Internet Freedom Foundation, a digital rights group, criticised the bank’s handling of the episode on Wednesday. “It does not say whether a single affected customer has been told,” the group wrote of the exchange filing, warning that leaked details such as names, dates of birth and branch information let fraudsters pose convincingly as bank officials. “Leaked data erodes that ability, and only notice from the bank lets the customer know to be on guard,” it said.
The foundation also pointed out that the filing dealt with 3,897 records out of roughly 3.75 lakh and did not address the PDF documents the hacker claims to hold, meaning the number of people affected could be larger.
In a representation to SBI’s chairman, copied to the Reserve Bank of India governor and CERT-In, it asked the bank to notify customers directly in several languages, set up a helpline and an online check for exposure, explain how the data leaked and confirm compensation for anyone who loses money.
A gap in the law
India’s Digital Personal Data Protection Act requires organisations to tell both the Data Protection Board and every affected person about a breach, but that provision is not yet in force and is expected to take effect only in May 2027. An RBI advisory issued in March recommends that banks notify affected customers by SMS, email, app alerts and calls, but it is not binding.
SBI’s statement on Friday suggests it has now done what the advisory asks. Its independent investigation into the source and scope of the leak is still under way.