By Hamza Faisal
The State Bank of India has moved from suspicion to confirmation. On Friday, the country's largest public-sector lender said it has individually informed all 3,897 customers whose data was identified in a suspected dark-web exposure — reaching out to each one directly through email and WhatsApp.
In a statement posted on social media, the bank reiterated its reassurance: "We reiterate that your account balances and funds are safe with us." The message, which the bank described as a follow-up to its earlier disclosure, stressed that customers should follow safe digital-banking practices and never share their OTP, PIN, or password with anyone.
The bank also urged customers to stay alert for suspicious calls, messages, and emails — a warning that matters now more than ever, since the very data leaked makes phishing attacks easier to personalize.
From 375,000 suspected records to 3,897 confirmed
The story began on October 16, when SBI said it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) about a suspected exposure of customer data on the dark web.
According to the bank's exchange filing, a preliminary analysis of approximately 375,000 records floating around the dark web narrowed the verified scope dramatically: 3,897 customer records containing personally identifiable information were confirmed. That is a sharp contraction from the 375,000 figure — but the confirmed data is sensitive enough. The exposed records reportedly included customer names, dates of birth, gender, registered mobile numbers, email addresses, and residential addresses, along with branch and customer-information-file (CIF) identifiers, lead IDs, and metadata tied to loan and lead records.
Notably, the bank's own tally is a far cry from the claims of a hacker group calling itself "Siriusim," which earlier this week alleged it had stolen 375,000 SBI customer records plus 2,722 PDF documents. Those claims, first flagged by the X account CyberPulse56, were never verified. SBI's preliminary analysis effectively replaced the unverified headline number with a confirmed — and far smaller — figure.
Response, investigation, and what comes next
SBI says it promptly activated its cyber incident response and containment protocols upon receiving the alert and engaged an independent, CERT-In-empanelled cybersecurity agency to conduct a comprehensive assessment. A detailed investigation is ongoing to verify the authenticity and scope of the exposed data, identify the source of the exposure, and assess the associated risks.
The bank has told regulators it does not expect the incident to have any material impact on its core business operations, financial performance, or business continuity.
Still, the episode lands at an uncomfortable moment for Indian banking. The country's central bank has been pushing lenders to strengthen their cybersecurity frameworks as threats against financial institutions keep rising — and India's largest bank is now the one answering for an exposure on the dark web. Whether SBI's quick notification and containment are enough to keep customer trust intact will depend on what the ongoing investigation finds — and whether the number stops at 3,897.
By Hamza Faisal
