State Bank of India, the country's largest public sector lender, has confirmed that customer information suspected to be linked to its customers has been found on the dark web, following a claim by an unidentified hacker group calling itself "Siriusim" that it had obtained confidential data allegedly linked to the bank.
In a formal disclosure on Wednesday, the bank said a preliminary review of around 3.75 lakh records circulating online flagged 3,897 records containing personally identifiable information.
The bank said it was alerted on October 16 by its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) about data suspected to be linked to SBI customers appearing on the dark web.
The details flagged include personally identifiable information such as mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata tied to loan and lead records.
The disclosure follows a claim made last week by the threat actor using the name "Siriusim". In a post on BreachForums, a site known for trading stolen data, the actor claimed to possess 3.75 lakh customer records and 2,722 PDF documents linked to SBI.
The claim was flagged on October 16 by the cybersecurity monitoring account CyberPulse56 on social media platform X. The listing described the data as a CSV file containing 3.75 lakh rows along with the PDF documents, and the poster shared four sample records as evidence.
The allegedly exposed dataset is said to contain customers' personal information, residential addresses, loan applications, supporting documents and other application-related records. According to CyberPulse56's reporting, Siriusim had presented the material as its first disclosure of the dataset. The Free Press Journal examined the sample records shared by the hacker group and found that the phone numbers were real.
Most of the data appeared to relate to loans, while some entries concerned savings account applications and customer acquisition.
However, the authenticity and origin of the alleged data exposure remain under investigation. The reported number of entries does not establish how many individual customers may have been affected, as multiple records could potentially relate to the same person. There has been no independent confirmation that SBI's systems were directly compromised or that the documents originated directly from the bank.
SBI moved quickly to reassure customers. The bank said that customers' money and banking are safe, and that accounts, funds and transactions continue to work as normal. "We wish to submit that this does not have any material impact on Bank's core business operations, financial performance or business continuity. The Bank's core business functions continue to operate normally without disruptions," the bank said in its disclosure.
It characterised the incident as a data exposure rather than a compromise of account access or money, and urged customers to remain cautious against phishing attempts.
The bank said it has switched on its cyber incident response and containment protocols. "Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise," SBI said. A detailed assessment is underway to establish whether the exposed data is authentic and complete, where it may have originated, and how far the exposure extends, along with the risks that follow.
Remedial and preventive steps are being put in place, the bank added.
CyberPulse56 warned that if the dataset proves genuine, the information could potentially be exploited for identity theft, financial fraud, targeted phishing attacks and fraudulent loan applications. The combination of names, mobile numbers, addresses, dates of birth and loan metadata is precisely the kind of material that enables convincing social-engineering attacks, in which fraudsters pose as bank officials to extract one-time passwords or account credentials.
The allegation comes amid broader concerns over cybersecurity risks facing India's financial sector. Earlier this year, the Reserve Bank of India stepped up cybersecurity requirements for commercial banks, reflecting the regulator's recognition that the threat landscape is intensifying.
Indian banks, which handle the financial data of hundreds of millions of customers, have become prime targets for threat actors, and several major institutions have faced similar claims in recent years.
What makes the SBI case significant is the scale of the country's largest lender. With hundreds of millions of customers and an unmatched branch network, any confirmed exposure of customer data at SBI carries systemic implications — not just for the affected individuals, but for confidence in the banking system.
The bank's prompt public disclosure, made through a stock exchange filing, follows the regulatory expectation that listed entities inform investors of material cybersecurity incidents.
For customers, the practical advice remains consistent with what security professionals recommend after any data exposure incident. SBI has urged caution against phishing — unsolicited calls, messages or emails seeking personal details, OTPs or passwords. Customers should verify the source of any communication claiming to be from the bank, avoid clicking on suspicious links, and report unusual activity on their accounts.
The bank has reiterated that it never asks customers to share passwords or OTPs.
The investigation will now focus on several open questions: verifying the authenticity and completeness of the records, tracing the possible source of the exposure, and assessing the risks associated with the compromised information. Whether the data came from SBI's own systems, a third-party vendor, or another link in the data chain will determine where the security failure — if any — occurred.
Banks increasingly rely on a wide ecosystem of technology partners, and breaches at any point in that chain can expose customer data.
The Siriusim group's identity and motives also remain unknown. Threat actors on forums like BreachForums typically seek either financial gain through sale of the data or reputational notoriety. The group's decision to share sample records is a common tactic to establish credibility with potential buyers.
SBI's preliminary findings do not establish that all 3.75 lakh entries contain compromised personal information or that an equivalent number of customers have been affected. The bank has yet to announce the outcome of its investigation or disclose whether additional customer records may be involved. As the CERT-In-empanelled agency completes its assessment, more clarity is expected on the scope and source of the exposure.
For India's banking sector, the episode is another reminder that cybersecurity is no longer a back-office function but a frontline concern. With digital banking transactions growing rapidly and threat actors becoming more sophisticated, the race between attackers and defenders shows no sign of slowing.
SBI's response — rapid disclosure, incident response activation, and an independent investigation — sets a template for how major institutions are expected to handle such incidents. The coming weeks will reveal whether the Siriusim claim amounts to a genuine breach or an exaggerated boast, but the 3,897 confirmed records are already enough to keep both the bank and its customers on alert.
(Reporting based on WION and YourStory.)