SBI Admits Dark Web Customer Data Exposure After Regulatory Alerts
Regulatory Disclosure Confirms Exposure of Customer Data on Dark Web
India's banking sector witnessed significant security scrutiny as Bank of India (SBI), India's largest commercial bank, on Wednesday, October 21 notified financial markets. Corporate disclosures detailed the suspected exposure of its customer data on the dark web, State Bank officials acknowledged in formal filings. Regulatory communications established that on the dark web, 3,897 customer records containing Personally Identifiable details were cataloged. Corporate officers affirmed Information (PII) were identified," SBI told the exchanges as per statutory governance norms. Confirming the scope, The State Bank of India (SBI) has confirmed that the personal details of 3,897 clients were compromised. Official tracking shows State Bank of India (SBI) has begun investigating a suspected data leak across online forums.
Tripartite Intelligence Warnings and Dark Web Dump Scale
Institutional warnings surfaced when Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert notified leadership teams. Chronological logs indicate SBI received communications on October 16 from the Defence Cyber Agency, initiating threat containment. Forensic teams commenced a preliminary analysis of approximately 375,000 records available on the dark web, the bank identified. The public dump originated from an entity calling itself "Siriusim" that it had released 3.75 lakh rows of database entries. Cybersecurity tracking noted a threat actor using the name âSiriusimâ had claimed on BreachForums, bragging about database exfiltration. Auditors confirmed identifying personal information in 3,897 customer records found on the dark web during deep scans.
Personally Identifiable Information Exposed and Containment Protocol
Data verification revealed The exposed information included customers' registered mobile numbers, dates of birth, and home addresses. Comprehensive audits indicated leaked information includes mobile numbers, dates of birth, names, gender, email addresses and geographical records. To counter the threat, administrators activated its cyber incident response and containment protocols and engaged an independent investigation firm. Technical experts sought to assess the extent of the exposure, and assess the associated risks to customers directly. External expertise was brought in as Additionally, an independent CERT-In-empanelled cybersecurity agency was commissioned for forensics. Regulatory compliance adhered to Under CERT-In's directions issued on April 28, 2022, all organisations must report data incidents promptly.
Consumer Protection Demands and Assessment of Operational Impact
Bank management affirmed The filing was made for investors' benefit and states that the incident will have no material financial harm. Bank spokespersons maintained the incident has not materially affected its financial performance, core business operations or client banking. Civil liberties advocates raised concerns as The Internet Freedom Foundation called on SBI to inform every affected account holder. Consumer privacy advocates warned These customers are the most likely to receive calls from persons masquerading as bank staff. Legal experts demanded that SBI must inform each affected customer by SMS, email or postal notification without delay.