State Bank of India reports dark web data breach affecting nearly 4,000 customers

State Bank of India has disclosed a cyberattack that leaked personal data of 3,897 customers on the dark web and hired an independent firm to investigate.

• SBI announced Wednesday that the cyberattack leaked personal data of 3,897 customers, identified among roughly 375,000 records found on the dark web.
• The bank said it received warnings on October 16 from a threat intelligence provider, India's cyber defense agency, and CERT-In, triggering its incident response protocols.
• SBI said exposed data includes customer names, phone numbers, birth dates, email and residential addresses, and loan records.
• SBI stated customer balances are "completely safe" and the breach has no material impact on operations, while an independent cybersecurity firm investigates.
• SBI disclosed the breach in a stock exchange filing on October 21, adding investigators still need to verify the data's validity.
• The leaked records include customer genders and customer IDs, while account numbers, balances, passwords, and card details were not exposed.
• Analysts linked the attack to a similar breach of Bank of Baroda in July, part of a pattern of cyber incidents facing Indian banks.