SBI Says Data Leak Hit “Very Small Number” of Customers; Core Operations Unaffected

Mumbai: State Bank of India (SBI), the country’s largest lender, has said that the recent cyber incident involving a data leak affected only a “very very small number” of customers. The bank assured that customer balances are “completely safe.”

In a notice shared on its official channels, the bank said the incident has no material impact on its IT systems, core business operations, financial performance or business continuity. It added that it is “taking all possible steps” to protect customers’ interests.

The bank reiterated that the safety of customers’ financial assets and data, and their trust in the bank, remain its highest priorities. The statement did not specify how many customers were indeed affected.

The bank's clarification comes after they confirmed data leak. On Wednesday, SBI has confirmed a data exposure involving customer information, identifying 3,897 records containing personally identifiable information (PII) in a preliminary analysis of around 375,000 records found on the dark web. The bank said it had activated its cyber incident response protocols and commissioned an independent cybersecurity agency to investigate the incident.

The confirmation follows claims made online in the past week. A threat actor known as “Siriusim” claimed on the cybercrime forum BreachForums that it had obtained 375,000 customer records and 2,722 PDF documents linked to SBI and its potential subsidiaries. The claim was reportedly highlighted on October 16 by a cybersecurity account on X. The group reportedly published four sample customer records and claimed to hold personal customer information, loan applications and supporting documents.

The Free Press Journal reported that phone numbers in the public samples were active, and that a WhatsApp profile photo matched the photo in one person’s KYC documents. This suggests at least some of the data corresponds to real individuals, but it does not verify the full dataset. It remains unclear whether the data is new or recycled from earlier leaks.