By Hamza Faisal
India's largest bank is at the center of a brewing cybersecurity drama. An anonymous hacker group calling itself "Siriusim" claims to be selling a database containing the personal data of roughly 375,000 State Bank of India customers — and nobody can yet say whether the data is real.
The claim surfaced on X, where the cybersecurity-focused account CyberPulse56 said Siriusim was offering a dataset of more than 375,000 SBI-linked accounts alongside 2,722 PDF documents. According to that report, the allegedly stolen material includes customer personal details, loan application records, account-opening forms, addresses, and supporting application documents. The threat actor is said to have described the offering as the "first disclosure" of the dataset.
The one problem: nobody has verified any of it
CyberPulse56 itself was careful to stress that the authenticity, source, and extent of the alleged exposure have not been independently verified. And at the time the story broke, SBI had not responded to queries seeking comment — leaving the claim sitting in an uncomfortable grey zone.
That silence matters. India has seen a wave of unverified breach claims in recent years, some of which turned out to be recycled older datasets being marketed as fresh. Until SBI responds, or independent researchers get their hands on the files and examine them, the Siriusim claim remains exactly that: a claim, not a confirmed breach.
Why it matters even before it's confirmed
If the dataset turns out to be legitimate, the risks are serious. The alleged material — loan applications, account-opening forms, addresses, and identity documents — is exactly the kind of personal data used for identity theft, financial fraud, targeted phishing campaigns, and fraudulent loan applications.
SBI is India's largest lender, and its shares are expected to be in focus as markets weigh the report. The bank's own website emphasizes that its digital banking platforms use authentication controls and encrypted communications, and advises customers against sharing passwords, PINs, and one-time passwords or responding to suspicious messages.
Banks are under sustained pressure
The claim lands at a time when Indian banks face tightening cybersecurity obligations. The Reserve Bank of India's cybersecurity directions require commercial banks to report cyber incidents through its DAKSH platform within six hours of detection and to proactively notify CERT-In. CERT-In's own directions carry a similar six-hour reporting window.
Whether the Siriusim claim turns out to be genuine, recycled, or fabricated, the episode is a reminder of how the modern breach economy works: a rumor on social media can move markets and panic customers before a single file has been authenticated. The real story now is what SBI says next — and what independent verification finds.
By Hamza Faisal
