SBI Data Leak: What Happened, What Data Was Leaked And What Account Holders Must Do

SBI Data Breach: The State Bank of India (SBI) is investigating a suspected data leak after personal information linked to 3,897 customers was identified in a dataset found on the dark web. The exposure raises concerns for customers, particularly over the risk of targeted financial fraud.

The country's largest state-run lender disclosed the incident in a filing with stock exchanges on October 21. It said a preliminary examination of around 3.75 lakh records available on the dark web had identified 3,897 records containing personally identifiable information.

The information includes customers' names, gender, registered mobile numbers, dates of birth, email addresses and residential addresses. The records also contain branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records.

Also Read | Layoffs Are Rising In Tech, But These Skills Are Helping People Unlock Better Pay

SBI said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about the suspected exposure. The bank has activated its incident response procedures and appointed an independent cybersecurity agency empanelled with CERT-In to investigate the incident.

In its exchange filing, SBI said, "The Bank promptly activated its cyber incident response and containment protocols." It added that the incident had no material impact on its business operations, financial performance or business continuity. The bank also said, "The Bank's core business functions continue to operate normally without disruptions."

However, the investigation is still underway. SBI said a detailed assessment was needed to establish the authenticity and completeness of the exposed data, identify its possible source and determine the extent of the exposure.

SBI Data Leak: Does This Mean Your Bank Account Has Been Hacked?

Not necessarily. The exposure of personal information and unauthorised access to a bank account are two different things.

The information identified in the dataset could help criminals build convincing stories when contacting customers. For instance, a fraudster who knows a customer's name, mobile number, address or loan-related details could pose as a bank employee, claim there is a problem with an application or account, and pressure the person into sharing confidential information.

The danger is that a call may sound genuine because the caller already knows personal details. Customers should not assume that someone is an authorised bank representative simply because they have information about them.

SBI's preliminary findings identify personal information and loan-related metadata among the exposed records. The available information does not establish that every affected customer's account credentials, passwords, PINs or transaction details have been compromised. Nor does the identification of 3,897 customer records establish that 3,897 bank accounts have been accessed or that money has been stolen.

The bank is still examining the authenticity, completeness and origin of the data. Customers should remain alert without assuming that their accounts have been hacked.

How Could Leaked Customer Data Be Misused?

Sarthak Dubey, Co-founder and COO at Mitigata, told NDTV that customer documents can be exposed through several systems beyond a bank's core banking infrastructure.

"Loan applications, KYC documents and account-opening forms typically sit across loan origination systems, employee email accounts, shared drives and third-party platforms used by sourcing agents and document-processing vendors. These systems can create exposure beyond a bank's core banking infrastructure," he said.

Dubey said compromised employee or vendor credentials, phishing, infostealer malware and incorrectly configured storage systems or application programming interfaces (APIs) were among the possible entry points.

However, he cautioned against drawing conclusions before investigators establish where the information came from. "Investigators will need to establish whether the data originated from SBI's systems, a third-party service provider or another source before drawing conclusions," he said.

He added that the incident highlights the importance of securing every system through which customer information passes, rather than focusing only on core banking infrastructure. "The danger is not just that someone has your data. It is that they can use it to make a fraudulent interaction look entirely legitimate," Dubey added.

The precise source of the SBI data exposure and the way the information could have been accessed remain matters for the investigation.

What Should SBI Account Holders Do?

Customers do not need to panic or automatically close their accounts because of this disclosure. They should, however, be cautious about unexpected calls, messages and emails, particularly those involving banking, loans or identity verification.

Dubey recommended the following precautions for SBI account holders:

• Never share an OTP, PIN or password: Do not disclose these details to anyone, even if the caller claims to be from SBI or another financial institution.
• Enable transaction alerts: Keep SMS and email alerts switched on, and review account activity regularly. Report transactions you do not recognise.
• Use official SBI channels: Access the bank through its official website, app or verified customer-service channels. Do not click on links sent by unknown people.
• Monitor your credit report: Check for unfamiliar loan accounts, credit cards or credit enquiries that you did not authorise.
• Consider locking Aadhaar biometrics: If you do not need biometric authentication, you can lock your biometrics through UIDAI's official channels.
• Report suspected fraud immediately: Call India's cybercrime helpline at 1930 or report the incident through cybercrime.gov.in. Also contact SBI through its official channels if you notice suspicious activity.

Dubey stressed that personal information alone does not prove that a caller is genuine. Customers should independently verify unexpected requests rather than relying on the caller's knowledge of their details. A request to share an OTP, PIN or password should be treated as a warning sign. Customers should never transfer money or install an app merely because someone claims their account is at risk.

What Can SBI Do Now?

According to Dubey, SBI's response should focus on three priorities: establishing the facts, containing the exposure and protecting customers who may be affected. 

First, the bank needs to verify the sample data, establish its origin and recency, identify the systems or third parties involved, and determine how many customers may be affected. It should communicate verified findings clearly.

Second, the bank should investigate the possible entry point, revoke compromised credentials where necessary, review access permissions and examine connections with vendors. Any exposed storage systems or APIs should be secured.

Third, SBI should identify potentially affected customers, notify them appropriately and strengthen fraud monitoring to detect attempts to misuse their information. Its response should examine not only how the exposure occurred, but also whether the data is being used to target customers.

As Dubey told NDTV, "A breach response cannot end with closing the vulnerability. The real test is whether the organisation can prevent the stolen information from being turned into fraud."

Core Banking Operations Remain Normal: SBI

SBI has said the incident has not materially affected its core business operations, financial performance or business continuity. Its investigation is continuing, and the bank has said it will take appropriate remedial and preventive measures in line with applicable regulatory requirements. For customers, the immediate priority is to protect their confidential banking credentials, verify suspicious communications independently and report any suspected fraud quickly.