SBI says it has told customers whose data leaked, after 3,897 records surfaced online
India's largest bank said on Friday that it had individually informed everyone identified in the dark-web exposure, two days after disclosing the incident to stock exchanges.
The Global Sun Desk ·
State Bank of India said on Friday, 23 October, that it has contacted every customer identified in a recent data leak, individually, by email and/or WhatsApp. In a statement on X, the bank said it wished to "reiterate that your account balances and funds are safe with us". It did not say how many customers it had contacted.
The statement followed the bank's disclosure on Wednesday that 3,897 customer records containing personal information had been found on the dark web.
What SBI disclosed
In a filing to the stock exchanges on 21 October, the country's largest lender said it had received alerts on 16 October from CERT-In, the government's computer emergency response team, the Defence Cyber Agency and its own threat-intelligence provider. The bank first screened roughly 3.75 lakh records circulating on the dark web, and 3,897 of them held customers' personal details.
The exposed fields covered names, registered mobile numbers, dates of birth, gender, email and home addresses, branch and customer information file (CIF) identifiers, lead IDs, and metadata attached to loan and lead records.
The bank said it switched on its incident response and containment procedures and brought in an outside security agency from CERT-In's empanelled list. It said the incident would not materially affect its core operations, its financial results or its ability to keep running. A detailed inquiry, it added, is still to settle whether the leaked data is genuine and complete, what its source is and how widely it spread.
Questions over disclosure
The Internet Freedom Foundation (IFF), a digital rights group, criticised the filing for assuring investors that the impact was not material without mentioning whether the individuals affected would be told. IFF has written to SBI, marking the Reserve Bank of India and CERT-In, to ask that all affected customers be informed at once.
IFF pointed out that the clause in the 2023 data-protection law (the DPDP Act) that would make such notice compulsory takes effect only in May 2027. It argued, though, that an RBI advisory from March 2026 already recommends that banks tell the customers concerned. The group added that on 16 October a security-monitoring account on X had reported a claim by an actor calling itself "Siriusim" to have published data tied to SBI, which in IFF's view means the leak was public before the bank said anything.
What customers are advised to do
SBI advised customers to bank safely online: keep their OTP, PIN and password to themselves, and stay wary of suspicious calls, messages and emails.
Reuters noted that the incident comes at a time when India's banking regulator has been pushing lenders to strengthen their cybersecurity frameworks, amid a rise in threats aimed at financial institutions.