State Bank of India confirms exposure of 3,897 customer records

State Bank of India (SBI) has confirmed that 3,897 customer records containing personally identifiable information were exposed on the dark web. The data breach, identified following alerts from national cybersecurity agencies including CERT-In on October 16, contains sensitive details such as mobile numbers, residential addresses, and dates of birth.

The bank conducted a preliminary analysis of approximately 375,000 data rows attributed to a threat actor circulating online. While the claims of a larger breach remain unverified by the bank, officials confirmed that 3,897 records were indeed linked to SBI customers, including metadata associated with loan applications and customer account identifiers.

SBI has initiated incident response protocols and engaged an independent, CERT-In-empanelled cybersecurity firm to audit the breach and assess potential risks. The bank stated that core operations remain unaffected and business continuity has not been disrupted. This incident adds to a string of recent data security challenges faced by the Indian financial sector, highlighting growing vulnerabilities to cyber threats.