The State Bank of India (SBI) has reported a suspected customer data exposure after personal information was found among records available on the dark web. In a stock exchange filing dated October 21, the country’s largest bank said its preliminary analysis identified 3,897 records containing personal information out of around 375,000 records examined.
SBI received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
The information identified reportedly includes customers’ names, mobile numbers, dates of birth, email addresses, residential addresses, branch details, Customer Information File (CIF) numbers and data linked to loan leads. The bank has appointed an independent cybersecurity agency to investigate the source and extent of the incident.
SBI said the incident had no material impact on its main operations, financial performance or business continuity. It has also reassured affected customers that their account balances and funds remain safe. However, the investigation is still underway, and exposure of personal information can increase the risk of targeted fraud.
How could scammers misuse the information?
Fraudsters may use a customer’s name, phone number or loan-related details to pose as bank officials. They might claim there is a problem with an account or loan application and pressure the person to reveal an OTP, PIN or password. A convincing caller ID or a message containing personal details does not prove that the caller is genuine.
Five steps to protect your account
- Never share your OTP, PIN, password or banking credentials.
- Do not click suspicious links or install apps suggested by unknown callers.
- Never transfer money to “secure” an account at someone’s request.
- Contact SBI through its official channels if you receive a suspicious call.
- Report suspected cyber fraud at cybercrime.gov.in or call 1930 immediately.
Customers should remain alert without panicking: a personal-data exposure does not automatically mean money has been stolen.
