Critical Customer Data Uncovered on the Dark Web

State Bank of India initiated an urgent investigation on October 21 after identifying sensitive personal information belonging to 3,897 customer records circulating on the dark web. The country’s largest public sector lender disclosed the security incident through a regulatory stock exchange filing following high-priority alerts regarding unauthorized exposure.

The alarming discovery emerged after the bank received warnings on October 16 from three distinct monitoring entities: its internal Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). Upon being notified of the illicit activity, security specialists conducted an initial assessment across approximately 375,000 records exposed in underground forums, ultimately pinpointing thousands of authentic user files.

Extensive Personal Identifiers and Loan Details Compromised

The compromised repository revealed an extensive trove of customer profiles that elevates fears surrounding data privacy risks and global financial security. According to the disclosure, the leaked documents contain highly sensitive identifiers, including full customer names, birth dates, gender designations, primary home addresses, registered contact telephone numbers, and email addresses.

Beyond basic contact data, the repository exposed sensitive banking architecture details. These compromised elements consist of Customer Information File (CIF) identifiers, specific branch codes, lead IDs, and critical metadata directly tied to customer loan records. Such granular exposure presents severe privacy hazards, enabling malicious actors to construct sophisticated financial profiling schemes.

Independent Cyber Audit Commissioned

In response to the detected breach, the lender triggered internal containment protocols and onboarded an external cyber forensic auditor empanelled by CERT-In to trace the origin and establish the full perimeter of the compromise. Investigators are currently evaluating the authenticity and completeness of the leaked records to assess the threat profile facing account holders.

Addressing the fallout and potential disruption to banking infrastructure, SBI maintained in its regulatory filing that standard operations remain insulated from the breach:

"The incident has not materially affected its financial performance, core business operations or ability to continue its services."

While the bank emphasized that core transaction systems continue without technical disruption, the presence of verified banking records on the dark web highlights persistent vulnerabilities within financial data management pipelines.