Today the State Bank of India (SBI) confirmed that it has sent individual alerts via email and WhatsApp to customers whose personal data was exposed in a recent cyber incident. In its advisory issued on October 23, the bank clarified that while data was identified on the dark web, account balances and funds remain secure. SBI emphasized that it has already contacted everyone whose records were found to be involved.
What Was Exposed?
The breach involved approximately 375,000 records discovered on dark web forums. Among these, 3,897 entries contained personally identifiable data such as names, mobile numbers, dates of birth, email addresses, residential addresses, gender, branch information, and customer file identifiers. Some records also included details tied to loan inquiries and lead-generation data. SBI noted that the larger figure refers to all records reviewed—not necessarily those of confirmed victims or compromised accounts.
How It Happened and SBI’s Response
SBI’s investigation is ongoing, and there’s no evidence yet that the attackers accessed the bank’s core systems or exploited a specific software flaw or malware. The bank was initially alerted on October 16 by its threat intelligence provider, India’s Defense Cyber Agency, and CERT-In, the country’s official cybersecurity incident response team. It responded by activating its incident response plan, appointing an independent agency under CERT-In oversight to probe the breach, and launching containment efforts.
Risk Mitigation and Guidance for Customers
Although sensitive contact and background details were exposed, SBI confirmed that no credentials—passwords, OTPs, or PINs—were found in the exposed data. However, the bank warned that loan or personal information could be sufficient for attackers to craft convincing phishing messages or social engineering attacks. Customers have been urged to stay alert for suspicious communications; to never share authentication codes; and to verify any unexpected message with official SBI channels. SBI’s guidance includes reporting incidents through [email protected] or India’s cybercrime helpline, 1930.
No Disruption to Banking Services
Despite the data exposure, SBI says its operations, financial performance, and service continuity have not been materially impacted. All essential banking functions remain unaffected.
Why this matters: This incident underscores how even when direct financial systems aren’t breached, exposure of customer data—especially contact and personal profile information—still poses serious risk through phishing and identity exploitation. Moving forward, it will be essential to see how SBI improves its data protection strategies and what regulatory or legal fallout may result from this kind of exposure. Customers should keep a close watch on communications, their accounts, and emerging transparency from SBI’s investigation.
