State Bank of India, the country’s largest bank, has confirmed in a stock-exchange filing that it experienced “an incident involving the loss of certain data” after 3,897 customer records turned up on the dark web. The bank said it does not yet know where the data came from or whether it is authentic, and the breach remains under investigation.
SBI Filing: 3,897 Records Within a 375,000-Record Dataset
In the filing on Wednesday, SBI said it found 3,897 customer records inside a dataset of about 375,000 records posted on the dark web. The 3,897 figure is preliminary and reflects roughly 1 in 100 of the records examined. It is not yet clear whether those entries represent 3,897 distinct people. The bank has not verified the full 375,000-record set.
Customer Data Fields Reportedly Exposed
The exposed fields reportedly include registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. The records also reportedly include branch and CIF identifiers, lead IDs and metadata tied to loan or lead records. Account numbers, balances, passwords, one-time passcodes, card details and PAN or Aadhaar numbers are not among the fields listed.
How SBI Learned of the Dark Web Listing
The bank received an alert on October 16 from its threat intelligence provider, CERT-In and the Defence Cyber Agency. It then activated its incident response process and engaged an independent auditor from CERT-In’s empanelled list to assess the incident. SBI described the response as incident response and containment, with an independent forensic assessment under way.
The five-day gap between the alert and the public filing is the interval in which the bank carried out those initial steps. The filing does not say how the data left the bank’s environment, and SBI has not said whether the data came from its own systems or from a third party.
The bank has described the incident in guarded terms. Its filing refers to the “loss of certain data” and does not state that its own systems were breached, because the origin of the dataset is unknown. The records appear to tie to lead and loan-related activity, given the lead IDs and metadata tied to loan or lead records among the listed fields.
The preliminary count reflects how the bank is working through the dataset. By examining roughly 1 in 100 of the 375,000 records, SBI arrived at 3,897 entries it could link to customers. If the same proportion held across the full set, the number could be far higher, but the bank has not made that projection and has said the figure is preliminary.
Phishing and Impersonation Risk From Combined Identifiers
The leaked records pair personal details with SBI’s internal identifiers, which is what makes the exposure useful to fraudsters.
Why Lead IDs and CIF Numbers Matter
The risk cited in connection with the leak is impersonation and phishing that combines personal details with internal identifiers. A message that cites a customer’s name, date of birth and CIF identifier, or a reference to a loan lead, could appear more credible than a generic scam message. The filing does not report any fraud cases linked to the leak.
What Remains Unverified
Several questions are open. The bank has not confirmed the dataset’s authenticity or origin, the size of the affected population, or whether all records belong to current SBI customers. The independent auditor’s findings will determine whether the 3,897 figure grows. Customers whose data was exposed are at risk mainly from social engineering, since the listed fields exclude credentials and payment card details.
The records exposed, if authentic, contain no credentials or payment details, according to the fields listed in the report on the filing. The combination the bank flags as risky is personal data with internal identifiers. Branch codes, CIF identifiers and lead IDs are the kind of details a caller could cite to make a fraudulent approach sound like it comes from the bank, which is why the filing names impersonation and phishing as the main risk.
The incident adds a major Indian financial institution to the list of organizations that have disclosed the appearance of customer data on dark web marketplaces.
