State Bank of India (SBI) is investigating a suspected data breach after 3,897 customer records containing personal information surfaced on the dark web, according to Reuters.
In a disclosure on 21 October, India’s largest lender said it had examined approximately 375,000 records found online.
Its preliminary assessment identified exposed details including customer names, mobile numbers, dates of birth, gender, email addresses and residential addresses.
The information also included branch and Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan and lead records.
SBI received alerts about the suspected exposure on 16 October from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
The bank subsequently activated its cybersecurity incident response and containment protocols. It also engaged an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive investigation.
The assessment will examine the authenticity and completeness of the exposed information, identify its potential source and determine the extent of the incident. Investigators will also evaluate possible risks to customers and the bank.
SBI said the incident has not materially affected its core business operations, financial performance or business continuity.
The disclosure comes amid growing cybersecurity threats targeting India’s financial institutions and increased regulatory scrutiny over data protection.
Featured image credit: Edited by Fintech News Singapore, based on image by muhammad.abdullah via Magnific
