"has experienced an incident involving the loss of certain data," the bank's stock-exchange filing said on October 21, laying out an investigation that so far has more questions than answers.
State Bank of India: the stock-exchange filing
The State Bank of India (SBI) disclosed in a filing dated October 21 that it had identified 3,897 customer records in a larger dataset of about 375,000 records available on the dark web. The bank described the count as preliminary and said it has "yet to establish whether the data is authentic, how far the exposure goes and what risk it poses to customers." The filing also states the incident "has no material impact on the bank's core business operations, financial performance or business continuity," a caveat the filing explicitly limits to the bank's business rather than to affected customers.
The alleged leak: 375,000 rows, 2,722 PDFs, and a BreachForums listing
The figure of roughly 375,000 records matches a social-media alert: on October 16 a monitoring account named CyberPulse56 flagged a listing and said a threat actor using the name Siriusim claimed to have leaked "375,000 rows in CSV format and 2,722 PDF documents." The seller's claim, the monitoring post said, included personal information, loan applications and supporting documents, account-opening forms and addresses.
Independent reporting by the Free Press Journal examined the BreachForums listing tied to the claim and found four sample records posted with the listing. That check showed the phone numbers in the samples were valid and that the WhatsApp profile picture on one number matched the passport-size photograph on that person's KYC document. The Free Press Journal cautioned that these checks cover only four records and do not prove the entire set is genuine or identify its source.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCERT-In, the Defense Cyber Agency, and the October 16 alert
SBI says the bank's threat intelligence provider, CERT-In (India's national computer emergency response team), and the Defense Cyber Agency alerted it on October 16. The bank says it activated incident response and containment procedures and engaged "an independent cybersecurity firm from CERT-In's panel of approved security auditors" to assess what the filing calls "the alleged compromise."
The filing names no attacker, forum, or dataset, and it does not tie the bank's analysis directly to the BreachForums listing or to the CyberPulse56 post. SBI also has not provided a date for when the data first appeared.
What the filing lists as exposed — and what it does not
According to the filing, the exposed information "reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files." A CIF identifier is the customer information file number, the bank's internal ID for each customer.
- The filing makes clear that account numbers, balances, passwords, one-time passcodes, card details and government identity numbers such as PAN or Aadhaar are not among the categories it lists.
- The filing also does not say whether the 3,897 records belong to 3,897 different people, what the remainder of the 375,000-row set contains, or whether the 2,722 PDFs claimed in the listing were part of the records the bank examined.
- The filing frames the most immediate customer risk as impersonation: a caller or message that uses a customer's name, mobile number, date of birth, address, branch, and internal ID to appear to come from the bank.
What this means for customers, cybersecurity teams, and regulators
- Customers: The bank has not said whether affected customers have been or will be notified. SBI's publicly available cybersecurity guidance, last updated in June, instructs customers to report cyber incidents to report.phishing@sbi.co.in or to the national cybercrime helpline, 1930 — guidance written before this incident.
- Cybersecurity teams and incident responders: SBI activated containment procedures and appointed an independent auditor from CERT-In's approved panel. The bank's filing leaves the origin of the dataset to the ongoing investigation and does not attribute the leak to a breach of an SBI system.
- Regulators and corporate risk officers: The filing follows a recent near-identical disclosure pattern used by another state-owned lender. On July 27 a different bank — Bank of Baroda — told the exchanges about an incident after receiving "a communication from an anonymous source claiming access to certain data" and, unlike SBI's filing, named a preliminary cause: "potential business email compromise."
For now the central facts are narrow and concrete: SBI says it found 3,897 customer records among a roughly 375,000-record set flagged on the dark web; the bank is investigating authenticity and scope; and multiple national cyber agencies informed the bank on October 16. The filing names no attacker, and independent checks tied to the BreachForums listing have so far covered only a handful of samples. The investigation's next tangible outcomes will be whether the bank can verify the provenance and completeness of the dataset, whether the 2,722 PDFs form part of the bank's exposure, and whether affected customers will be identified and notified.
