SBI says customer funds safe after data breach exposes 3,897 records

State Bank of India says customers’ account balances and funds remain safe after 3,897 records containing personal information were reportedly exposed on the dark web. The lender has notified affected customers and engaged an independent cybersecurity agency to investigate.

New Delhi: India’s largest lender — State Bank of India (SBI) — on Friday stated that account balances and funds of customers remain safe following a recent cyber incident that led to exposure of 3,897 customer records on the dark web.

In a statement that was shared on social media platform X, the lender said, “Further to our earlier post regarding the recent cyber incident, the lender has individually informed all customers whose data was identified as being involved through email and/or WhatsApp. We reiterate that your account balances and funds are safe with us.”

---

The bank advised customers to follow safe digital banking practices, never share OTP, PIN or password with anyone and remain vigilant against suspicious calls, messages and emails.

The statement came after India’s largest lender clarified earlier this week that it had experienced a data breach, with 3,897 customer records found exposed on the dark web.

Earlier in the week, the bank said it had received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In regarding an alert concerning suspected exposure of customer data.

During preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified, the bank had said in an exchange filing.

The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and metadata associated with loan or lead records and other related files, it added.

The state-owned lender said it promptly activated its cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise.

A detailed investigation is underway to establish authenticity and completeness of the exposed data, determine potential source and extent of exposure and assess associated risks, it said.