The State Bank of India (SBI) on Wednesday informed the Bombay Stock Exchange and the National Stock Exchange that it had suffered “an incident involving the loss of certain data,” with 3,897 customer records containing personal information identified within a larger trove of about 3.75 lakh records on the dark web.
The exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF (Customer Information File) identifiers, lead IDs, and metadata linked to loan records and other files. The filing, however, does not mention how the data left the bank’s systems. SBI’s disclosure does not mention the documents. IFF called on SBI to notify every affected customer directly through SMS, email and letter, in English, Hindi and the regional language of the customer’s branch about the incident.
In a disclosure under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, the bank said it learnt about the incident on October 16 through its threat intelligence provider, the Defence Cyber Agency and Cert-In. The group claimed to have released 3.75 lakh rows of SBI data and 2,722 PDF documents, including loan applications and account-opening forms. The group said there is currently no law in force that mandates banks to inform customers but section 8(6) of the Digital Personal Data Protection Act, 2023 requires a breach to be reported to the Data Protection Board and to each affected person, and Rule 7 of the DPDP Rules, 2025 sets out how.
SBI said it had activated its incident response protocols and engaged an independent Cert-In-empanelled agency to establish the authenticity of the data, its source and the extent of the exposure. It said the incident has no material impact on its core operations, financial performance or business continuity. Digital rights group Internet Freedom Foundation (IFF) said that on the day SBI received the alert, a threat-monitoring account on X flagged a claim by a group calling itself “Siriusim.
IFF has also asked for a helpline, a facility to check whether one’s data is affected, and disclosure of whether KYC documents such as Aadhaar, PAN or passport copies were exposed. It further asked the bank to disclose, once the investigation ends, whether the data left through a vendor or a direct selling agent.
