SBI confirms data leak, appoints cybersecurity agency to conduct assessment
MUMBAI: The State Bank of India (SBI) has confirmed a data exposure involving customer information, identifying 3,897 records containing personally identifiable information (PII) in a preliminary analysis of around 375,000 records found on the dark web. The bank said it had activated its cyber incident response protocols and commissioned an independent cybersecurity agency to investigate the incident after receiving alerts from its threat intelligence service provider, the Defence Cyber Agency and CERT-In on Oct 16.
The disclosure follows a claim by cybersecurity monitoring account CyberPulse that a threat actor using the name Siriusim had leaked documents and personal data allegedly linked to SBI. The post claimed the dataset contained 375,000 rows in CSV files and 2,722 PDF documents, including customer information, loan applications, supporting documents, account-opening forms and addresses. The authenticity and full extent of the alleged exposure had not been independently verified in the post.
In its notice to stock exchanges, SBI said the preliminary analysis had identified records containing customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs and metadata associated with loan and lead records and related files. A CIF identifier is a unique number banks use to maintain a customer's consolidated relationship and account information. Lead IDs typically identify prospective customers or applications in a bank's sales and lending processes.
The bank said a detailed investigation was needed to establish the authenticity and completeness of the exposed data, determine its source and extent, and assess the risks to customers and the bank. It has engaged a cybersecurity agency empanelled by CERT-In, India's national cyber incident response agency, to conduct an independent assessment.
SBI said the incident had no material impact on its core business operations, financial performance or business continuity, adding that its core functions continued to operate normally. It said the assessment was underway and remedial and preventive measures were being implemented.
A threat actor is an individual or group that carries out, or claims to carry out, a cyberattack or other malicious activity. The term does not by itself establish who is responsible or whether a claim of a breach is genuine. The dark web refers to parts of the internet that are not accessible through standard search engines and typically require specialised software or configurations to access. It is sometimes used to trade stolen information, although the appearance of data there does not, by itself, establish how it was obtained.
PII refers to information that can identify a person, either directly or when combined with other details. Names, phone numbers, dates of birth and residential addresses can be used for identity theft, targeted phishing and other forms of fraud if exposed. Metadata associated with loan applications may also reveal information about a customer's dealings with a bank.
The disclosure follows a claim by cybersecurity monitoring account CyberPulse that a threat actor using the name Siriusim had leaked documents and personal data allegedly linked to SBI. The post claimed the dataset contained 375,000 rows in CSV files and 2,722 PDF documents, including customer information, loan applications, supporting documents, account-opening forms and addresses. The authenticity and full extent of the alleged exposure had not been independently verified in the post.
In its notice to stock exchanges, SBI said the preliminary analysis had identified records containing customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs and metadata associated with loan and lead records and related files. A CIF identifier is a unique number banks use to maintain a customer's consolidated relationship and account information. Lead IDs typically identify prospective customers or applications in a bank's sales and lending processes.
The bank said a detailed investigation was needed to establish the authenticity and completeness of the exposed data, determine its source and extent, and assess the risks to customers and the bank. It has engaged a cybersecurity agency empanelled by CERT-In, India's national cyber incident response agency, to conduct an independent assessment.
SBI said the incident had no material impact on its core business operations, financial performance or business continuity, adding that its core functions continued to operate normally. It said the assessment was underway and remedial and preventive measures were being implemented.
A threat actor is an individual or group that carries out, or claims to carry out, a cyberattack or other malicious activity. The term does not by itself establish who is responsible or whether a claim of a breach is genuine. The dark web refers to parts of the internet that are not accessible through standard search engines and typically require specialised software or configurations to access. It is sometimes used to trade stolen information, although the appearance of data there does not, by itself, establish how it was obtained.
PII refers to information that can identify a person, either directly or when combined with other details. Names, phone numbers, dates of birth and residential addresses can be used for identity theft, targeted phishing and other forms of fraud if exposed. Metadata associated with loan applications may also reveal information about a customer's dealings with a bank.
Next Story