State Bank of India told the country's stock exchange that it is investigating a suspected dark web leak in which 375,000 records were listed, 3,897 of them reported to be customer records containing personally identifiable information (PII).
According to the filing, the bank was alerted in mid-October by its threat intelligence provider, the Defence Cyber Agency, and CERT-In, India's national cyber emergency response team. The exposed fields reportedly include registered mobile numbers, dates of birth, names, gender, email and residential addresses, branch and CIF identifiers (the bank's internal customer file numbers), lead IDs, and metadata tied to loan records. SBI has not verified that the data is authentic, and does not know who leaked it or how they got it. It triggered incident response protocols and brought in an independent forensic firm empanelled by CERT-In. The bank said the incident has no material impact on operations.
The claim traces to an October 16 post on BreachForums, a popular cybercrime forum, by an actor calling itself Siriusim. An X account named CyberPulse56 flagged it. The poster claimed 375,000 CSV rows and 2,722 PDF documents, including loan applications, account-opening forms and supporting papers. A newspaper's check found that at least some of the sample was authentic: a WhatsApp profile photo tied to one number matched the passport-size photo on that person's KYC (know-your-customer) document. The sample leaned toward loan data.
That shows some of the people are real. It does not show where the data came from. No link has been established between the data and SBI, its subsidiaries, or its supply chain providers. Data like this can come from an older breach, from a different organization, or from several earlier leaks repackaged together, a habit among cybercriminals.
The exposure matters either way. Addresses, CIF numbers and loan details make phishing emails far more convincing. Customers should treat urgent messages claiming to be from the bank, especially ones threatening account closure, with suspicion.
The forensic review has to settle what the filing leaves open: whether this is SBI's data, and if so, whether it left through SBI's own systems or someone else's.