SBI Data Leak: What Happened and How to Protect Your Business and Customers

State Bank of India (SBI), the country’s largest public-sector bank, has confirmed it is investigating a suspected data leak after customer records appeared on the dark web. Details are still emerging, but the incident is a useful reminder for every organisation that handles customer data.

Here is what is known so far, and what you can do about it.

What happened?

SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and CERT-In, about a suspected exposure of customer data. In a stock exchange filing on 21 October, the bank said a preliminary analysis of around 3.75 lakh records found 3,897 containing customer personal information.

Separately, a user calling themselves “Siriusim” posted on a data breach forum, claiming to hold SBI customer data, including a large table of records and thousands of PDF documents. These claims have not been independently confirmed.

What data was exposed?

According to the bank’s disclosure, the records included:

• Names and gender
• Registered mobile numbers
• Dates of birth
• Email and residential addresses
• Branch and Customer Information File (CIF) identifiers
• Lead IDs and loan-related metadata

Some follow-on media reports suggest more sensitive items, such as KYC details, may also be involved. SBI’s own statement does not confirm this, so treat those reports with caution until the bank says more.

What is still unknown?

• The source. SBI has not said how the data got out. It could involve a third-party vendor, a partner system or an internal process.
• Whether its systems were breached. The bank describes the exposure as suspected, pending the investigation.
• Whether the data is genuine and complete. The bank is still verifying it.
• Whether customers will be notified. This has not been addressed in the reports we reviewed.

The bank has said its core business operations continue normally.

Why a “small” leak is still serious

3,897 records is a small share of a very large dataset, but personal details like names, phone numbers and loan information are exactly what scammers use to build convincing fraud:

• Phishing and vishing: a caller who knows your name and loan details sounds legitimate
• Identity theft: combined with other leaked data, these details can be used to impersonate someone
• Targeted loan and KYC scams: fake “verification” requests that harvest OTPs and documents

What should individuals do?

• Don’t share OTPs, PINs or passwords with anyone, even someone who knows your details
• Be suspicious of unexpected calls, SMS or links about KYC updates, loans or account blocks
• Contact the bank only through its official app, website or number
• Monitor your account for unfamiliar transactions and report them quickly

What should businesses learn from this?

You don’t have to be a bank to be a target. Any business that stores customer names, phone numbers, documents or payment details faces the same risk. Here are six steps to start with:

1. Map your data. Know what customer data you hold, where it lives and who can access it.
2. Review your vendors. Leaks often come through third parties. Check how your partners protect your data.
3. Limit access. Give people only the access they need, and use multi-factor authentication.
4. Monitor for exposure. Watch for your company’s data and credentials appearing in leaks.
5. Prepare an incident response plan. Decide in advance who does what, and how you’ll notify customers and authorities.
6. Train your team. Most attacks begin with a convincing message to a person.

How CyberCure can help

We support businesses with:

• Security assessments to find where your data is exposed
• Vendor and third-party risk reviews
• Monitoring for leaked credentials and data
• Incident response planning and support

Worried about your own data exposure? Send us a DM on LinkedIn or use the contact form below, and we’ll help you check.

Contact our cybersecurity experts:

📱 WhatsApp: https://wa.me/919555554999
✉️ Email: info@cybercure.in

CyberCure — Secure Your Digital Future.

Disclaimer: This article reflects publicly reported information at the time of writing. The investigation is ongoing and details may change. Customers should follow official SBI communication.