State Bank of India: 3,897 customer records with personal data found on dark web in ~375,000-record leak
Severity: medium · Patch status: no-fix-needed · Since 2026-10-16
State Bank of India confirmed in an October 21 stock-exchange filing that 3,897 customer records containing personal data were identified within a set of about 375,000 records offered on the dark web by a threat actor named Siriusim on BreachForums. Exposed fields reportedly include names, mobile numbers, dates of birth, email and residential addresses, branch and CIF identifiers, and loan/lead metadata; account numbers, balances, passwords, OTPs, card details, PAN and Aadhaar are not listed. The alert came October 16 via CERT-In and the Defense Cyber Agency; an independent CERT-In-panel firm is investigating. The bank has not confirmed data authenticity, the source, whether SBI systems were breached, or customer notification. Main risk is impersonation/social-engineering against affected customers.
What to do
- Treat exposed fields (name, DOB, phone, address, CIF ID) as usable for convincing phishing and vishing; brief fraud and support teams on SBI-themed impersonation attempts
- If you are an SBI customer or partner, be suspicious of unsolicited calls/messages citing your personal details or loan applications; verify via official channels and report to 1930 or report.phishing@sbi.co.in
- Monitor for further disclosures on scope, authenticity, and affected customers; review third-party/loan-processing data handlers as a possible source
- Harden KYC and loan-application data handling and vendor access controls at financial organisations handling similar data
Sources
All live incidents on Threat Watch
