State Bank of India Leaks 375,000 Records on Dark Web

How the State Bank of India breach was discovered

National defense and cybersecurity monitors alerted the bank in mid-October after noticing internal records circulating on criminal forums.

In a regulatory filing submitted to Indian stock exchanges, State Bank of India confirmed it suffered an incident involving the loss of certain data. The bank first learned of the exposure through warnings issued by its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In).

The leak appeared on BreachForums, where a threat actor operating under the handle Siriusim published a trove containing 375,000 CSV rows alongside 2,722 PDF documents. Independent verification by local press confirmed that at least some data is real: one leaked phone number corresponded to a WhatsApp profile picture that matched the passport photograph submitted in an attached Know Your Customer (KYC) filing.

Unlike massive credential dumps, like the incident where stolen passwords exposed data of 17 million students, this repository focuses heavily on credit evaluation records. Files include customer full names, gender, registered mobile numbers, home addresses, branch codes, CIF identifiers, and internal lead markers.

Third-party vendor or direct intrusion?

SBI maintains that its core banking operations remain unaffected and that basic branch services continue without interruption. However, forensic teams are still trying to determine where the breach actually happened.

The bank has brought in an independent, CERT-In-empanelled cybersecurity firm to audit its systems. A major question is whether attackers compromised SBI's internal infrastructure directly or harvested the records from an external loan sourcing partner or credit verification contractor. Third-party risks remain a persistent blind spot across financial networks.

Investigators also caution that threat actors frequently repackage older corporate leaks to drum up attention. Still, the presence of specific loan leads and fresh KYC documents suggests recent activity rather than recycled scrapings.

The immediate threat: hyper-targeted phishing

While attackers did not walk away with core account balances or payment processing control, the exposed data provides everything needed for convincing fraud.

Armed with branch locations, active loan application statuses, and CIF identifiers, scammers can launch targeted phishing campaigns against affected customers. A phone call referencing an exact pending loan application or residential address bypasses standard fraud suspicion, leading victims to divulge one-time passcodes or authorization credentials.

SBI customers are being urged to treat unexpected emails or text messages claiming account suspension or urgent loan reviews with extreme suspicion.

What it means for international customers

SBI operates dozens of overseas branches across the United States, the United Kingdom, and the European Union, handling commercial loans and remittances. The regulatory disclosure did not specify whether international client accounts were caught in the 375,000-row sample, as the leaked files primarily show domestic Indian KYC requirements.

Customers holding cross-border accounts or using SBI remittance platforms should still verify that two-factor authentication is active and monitor linked email accounts for phishing attempts.

As forensic auditors parse server logs to identify the intrusion vector, the incident serves as a sharp reminder that customer onboarding documents often remain the softest target in retail banking.