State Bank of India Investigates Customer Data Exposure Found on Dark Web

A data exposure incident has hit India’s largest state-owned lender, with details of a State Bank of India data leak coming to light following a stock exchange filing dated October 21. The bank confirmed it is investigating the potential compromise of customer records after thousands of personal files appeared on cybercrime forums. Threat intelligence alerts originally flagged the dark web listing on October 16, prompting bank officials and national cyber defense agencies to launch an incident response operation. While core banking infrastructure and financial transactions remain unaffected, the exposure of internal customer identifiers creates a high-risk vector for targeted social engineering and vishing campaigns against retail account holders.

What Happened

The incident surfaced when threat intelligence account CyberPulse56 flagged a dark web listing posted by a threat actor operating under the handle “Siriusim.” The threat actor claimed to possess a dataset containing approximately 375,000 rows of customer data in CSV format, accompanied by 2,722 PDF files containing loan application forms, identity documents, address proofs, and supporting Know Your Customer (KYC) records linked to State Bank of India (SBI) customers.

Sample data published on BreachForums was independently reviewed by researchers, who confirmed that mobile numbers in the posted samples were active. In at least one case, a passport-sized photograph on an exposed KYC document matched the active WhatsApp profile picture associated with the listed phone number.

SBI was alerted on October 16 by the Computer Emergency Response Team of India (CERT-In) alongside the Ministry of Defence’s Defense Cyber Agency. In response, SBI activated its incident response framework and retained an independent cybersecurity auditing firm from CERT-In’s panel. In its October 21 regulatory filing, the bank confirmed it “has experienced an incident involving the loss of certain data.” SBI’s preliminary analysis verified that 3,897 customer records—roughly 1% of the initial sample evaluated—contained genuine customer details, though the full scope and authenticity of the larger dataset remain under investigation.

What Was Exposed and the Blast Radius

According to SBI’s disclosure, the compromised data categories include personally identifiable information (PII) alongside bank-internal routing metadata:

• Full names, gender, and dates of birth
• Registered mobile numbers and email addresses
• Residential and mailing addresses
• Branch codes and Customer Information File (CIF) identifiers
• Lead IDs and metadata associated with credit applications and loan files

Core financial credentials—such as account passwords, PINs, payment card numbers, one-time passcodes (OTPs), account balances, and government identification numbers like Aadhaar or PAN—were not included in the filing’s list of exposed fields.

While the absence of credentials prevents direct unauthorized account access or automated fund transfers, the exposure creates a dangerous footprint for voice phishing (vishing) and identity theft. In modern banking fraud, attack teams synthesize internal organization identifiers—like a customer’s specific branch, loan lead ID, and CIF number—with basic PII. When a caller recites an exact internal CIF number and home address, victims are far more likely to believe the call is genuine, making it significantly easier for fraudsters to trick account holders into authorizing step-up authentication requests or sharing OTPs.

Potential Vectors: The Vendor and Direct Sales Ecosystem

SBI has not declared an internal network breach, leaving open the exact source of the leak. In large retail banking environments, customer lead databases and scanned PDF documentation rarely sit directly on primary core banking platforms like Finacle or TCS BaNCS. Instead, structured lead records and onboarding attachments typically flow through secondary enterprise systems, including:

• Loan Origination Systems (LOS): Applications that ingest credit leads, process pre-approval scoring, and store scanned supporting documents.
• Direct Sales Agents (DSAs) and Lead Aggregators: Third-party partners that collect customer leads, conduct initial document gathering, and feed files to the bank via APIs or batch transfers.
• Cloud Storage Repositories: Misconfigured storage buckets or unprotected vendor SFTP instances used during third-party processing.

This pattern aligns with a similar security incident disclosed on July 27 by Bank of Baroda, another major Indian state-owned bank, which filed a near-identical exchange notice regarding “the alleged compromise” following an anonymous data exposure claim attributed to potential business email compromise (BEC) at an partner level.

Mitigation and Defense Guidance

Because the primary threat stemming from this leak is human-targeted deception rather than technical exploit execution against bank endpoints, defense must center on identity verification controls and proactive threat monitoring.

For Enterprise Security Operations and Fraud Teams:

• Audit Third-Party Ingestion Endpoints: Review access rights, API keys, and file-transfer logs for all external loan origination vendors and DSA integration platforms to identify unusual bulk export activity.
• Strengthen Telephony Verification: Fraud teams should update customer service workflows so that internal numbers like CIF IDs or Lead IDs are never treated as sole proof of caller identity during inbound support inquiries.
• Monitor Brand Impersonation Channels: Monitor domain registrations and messaging channels (such as WhatsApp and Telegram) for campaigns impersonating SBI loan processing departments targeting recently exposed leads.

For SBI Customers and Retail Account Holders:

• Verify Incoming Calls Out-of-Band: Never share OTPs, banking passwords, or card details over the phone. If a caller claiming to represent SBI recites your CIF number or loan application details, hang up and call the official customer care number listed on the back of your debit card or visit a local branch.
• Report Suspicious Activity: Forward fraudulent calls or phishing messages to [email protected] or register complaints through India’s National Cyber Crime Helpline by calling 1930.