Mumbai-based State Bank of India has officially confirmed a data breach involving 3,897 customer records, a stark admission following alerts from the Defence Cyber Agency and CERT-In on October 16. The bank’s preliminary analysis of a massive 3.75 lakh-record dataset found on the dark web revealed specific personal identifiers, shattering the silence that often follows such digital intrusions. While the threat actor, operating under the alias Siriusim, claimed to have leaked 2,722 PDF documents and CSV files, SBI’s own verification narrowed the confirmed exposure to under 4,000 individuals.
The confirmed data points are gritty and specific: registered mobile numbers, dates of birth, residential addresses, and crucially, Customer Information File (CIF) identifiers. These aren't just metadata; they are the keys to your financial life. With CIF numbers, fraudsters can impersonate customers to take over accounts or apply for loans in someone else's name. SBI acknowledged this precise risk, noting that the leak opens the door for benefit fraud and account takeovers, though the bank insists its core business operations remain unaffected.
The incident traces back to a post by cybersecurity monitoring account CyberPulse, which flagged the Siriusim leak. SBI did not wait for full independent verification to act; it immediately activated cyber incident response protocols. The bank has since engaged an independent cybersecurity agency empanelled by CERT-In to conduct a forensic deep dive. This third-party assessment aims to establish the authenticity of the remaining unverified records and pinpoint the exact source of the leak, whether it was an insider threat or an external penetration.
For the 3,897 customers identified, the next few weeks will be a wait for remedial measures. SBI stated that preventive steps are already being implemented, but a detailed investigation is still under way to determine the full extent of the damage. The bank’s notice to stock exchanges emphasizes that while the breach is real, its financial impact is currently non-material. However, the trust deficit with customers who see their birth dates and home addresses floating on the dark web is a harder metric to quantify.