State Bank of India confirms leak of 3,897 customer records with PII and loan data on the dark web

What happened

State Bank of India reported a cyberattack on Wednesday that led to the disclosure of 3,897 customer records containing personally identifiable information on the dark web. The bank said preliminary analysis also showed approximately 375,000 records available on the dark web, and it has engaged an independent cybersecurity agency to assess the nature and extent of the leak. It said the leak is not expected to materially affect core operations, financial performance or business continuity Indian Express.

Dark Reading reports that the bank’s compliance and company secretary acknowledged the 3,897 leaked records in a notice to the National Stock Exchange, without saying whether they belong to 3,897 individual customers. A new account named “Siriusim” posted on BreachForums claiming SBI data, including a table with 375,000 rows and 2,722 PDF files. Neither figure necessarily shows how many individuals are affected. Mumbai’s Free Press Journal verified that PII in the samples was valid and belonged to real Indian citizens Dark Reading.

The data types SBI acknowledged were names, genders, mobile numbers, email addresses, home addresses, dates of birth, bank profile IDs, loan metadata and “other files.” Follow-on reporting out of Mumbai suggested the extra data included Central KYC numbers, video KYC verification data and account or loan application documents, such as an employment and income declaration. That follow-on detail comes via Dark Reading and is not confirmed by SBI in the sources Dark Reading.

The cause of the leak is not confirmed. Dark Reading notes that the bank says core functions are running normally and speculates the clues might point to a peripheral digital service or data-handling system, but this is not confirmed. As of November 3, an SBI executive confirmed the inquiry is still underway, the bank has not declared the assessment complete, and specific findings have not been released The 420.in.

Am I affected?

• SBI has not published a way for customers to check whether their record was included. This is not confirmed in the sources.
• Whether affected customers are being notified individually is not confirmed.
• Counts differ by source and by definition. SBI says 3,897 customer records were leaked, while about 375,000 records are said to be available and under review Indian Express. The full number of people affected is not confirmed.
• The bank described the impact as a “very, very small number of customers,” and Dark Reading puts the share at about 0.0008% of customers. The leaked data still carries real risk for those people Dark Reading.
• You are more likely to be exposed if you recently opened an SBI account or applied for a loan, since the leaked material reportedly includes new account and loan application files. This is based on the BreachForums post as described by Dark Reading, not on a confirmed SBI statement.

Security researcher Sushant Bhardwaj says that if the data is genuine, the main risk is not direct account theft but credible-sounding phishing, vishing, and identity or loan fraud. He adds that KYC details are hard to change, and that a caller who can quote real loan details can pose as the bank or a recovery agent to pressure a borrower into paying a “fee” or sharing a one-time password Dark Reading.

What to do now

1. Treat unsolicited calls, SMS, emails and messages that claim to be from SBI or a loan recovery agent as suspect, even if they quote your real name, loan details or other personal data. Hang up and contact the bank through a channel you already trust.
2. Never share an OTP, and never pay a “fee” to a caller who contacts you first, since attackers who know loan details can pose as the bank or a recovery agent.
3. Watch for signs of identity or loan fraud, such as credit applications in your name or unexpected account-verification attempts, because KYC details are hard to change.
4. If you work in security at an organization with SBI customers or staff, brief them on bank impersonation phishing and vishing that uses accurate personal and loan details.
5. Follow official SBI and NSE disclosures for updates, since the independent assessment is not complete and the scope, cause and any notification process are not confirmed The 420.in.
6. Be aware that leaked data can be combined with other lookup services. Cyderes’ Brian Hussey describes an Indian underground market that can turn a mobile number into a subscriber identity, an employment history and registered vehicles, so limit what you disclose on calls or forms Dark Reading.

Sources

• Indian Express (Reuters), SBI says 375,000 records leaked on dark web, 3,897 had personal details
• Dark Reading, State Bank of India Suffers a Customer PII Data Leak
• The 420.in, Inquiry Into Data Breach Is Still Underway, Says SBI Executive