The State Bank of India is investigating how nearly 3,900 customer records ended up on the dark web, raising concerns about the potential for targeted financial fraud.
SBI disclosed the incident in an Oct. 21 stock exchange filing, saying a preliminary review of approximately 375,000 records found on the dark web identified 3,897 customer records containing personally identifiable information. The preliminary count does not establish the total number of affected customers.
The exposed information reportedly included customer names, mobile numbers, dates of birth, email addresses, residential addresses, branch and Customer Information File (CIF) identifiers, lead IDs, and loan-related metadata, according to Cyber Security News.
SBI said it received alerts on Oct. 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). The bank has hired an independent cybersecurity agency empanelled with CERT-In to investigate the incident, assess the authenticity and completeness of the data, and determine its source and the extent of the exposure. SBI has not established publicly how the information was obtained or whether its core banking systems were compromised.
Personal information could fuel targeted scams
Although the incident involves customer records, it does not establish that bank accounts were accessed or funds stolen. SBI said customer balances remain safe and the incident has not materially affected its operations, financial performance or business continuity.
However, the exposed information could make fraudulent communications more convincing. Criminals with access to customer names, addresses and loan-related details could impersonate bank representatives, reference genuine application information and pressure customers into disclosing confidential credentials.
In comments to NDTV, Sarthak Dubey, co-founder and chief operating officer of Mitigata, noted that loan applications and customer documents can pass through systems outside a bank's core infrastructure, including employee email accounts, shared drives and third-party processing platforms.
The investigation must go beyond finding the leak
SBI has activated its incident response procedures and said it is implementing remedial and preventive measures. The investigation will need to establish whether the records are authentic, how current they are and whether additional customer information is at risk.
The incident also raises questions about how banks communicate potential exposure to customers. In an Oct. 21 statement reported by Moneylife, the Internet Freedom Foundation urged SBI to notify affected customers directly, explain what information was exposed and provide a dedicated helpline.
For bank security teams, the practical lesson is to trace customer information beyond core transaction systems. Loan-processing platforms, document repositories, employee accounts and vendor environments should be included in access reviews and monitoring. None has been identified publicly as the source of SBI’s exposure.
Investigators should establish when the records were created, whether they contain duplicate entries and which systems held the same information. Those findings can help determine whether the material reflects a current exposure, older data or information collected from multiple sources.
Security and fraud teams should also coordinate their response once affected records are verified. Monitoring should account for impersonation attempts that reference genuine loan or customer details, while customer warnings should explain what information was exposed and how to verify unexpected requests.
Customer-support procedures deserve attention too. Staff should avoid treating knowledge of an address, date of birth or loan reference as sufficient proof of identity. The response should address both how the information became exposed and how someone might use it to obtain further access.
What SBI customers should do now
Customers do not need to assume their accounts have been hacked, but they should be alert to unexpected communications involving their banking or loan applications.
- Never share PINs, passwords or one-time passwords (OTPs): Legitimate-looking messages and calls can still be fraudulent.
- Verify requests independently: Contact SBI through its official channels rather than using links or phone numbers supplied in suspicious messages.
- Monitor account activity: Report unauthorized transactions to the bank immediately.
- Watch for identity misuse: Be cautious of unfamiliar loan offers, verification requests or callers who use personal details to establish credibility.
The available findings do not confirm that passwords, PINs or OTPs were exposed. Until SBI completes its investigation, the main concern is whether the disclosed personal information could be used to target customers and whether the bank can establish the source of the exposure and prevent further misuse.
Read more: Learn how criminals are abusing open-banking services to test stolen bank logins and what financial security teams should monitor before money moves.