State Bank of India Confirms Breach of Customer Records
State Bank of India confirmed a cyberattack exposing nearly 3,900 customer records after threat actors previously claimed a much larger data leak.
The State Bank of India confirmed on Wednesday that a cyberattack exposed 3,897 customer records on the dark web. The leaked data includes names, mobile numbers, dates of birth, email addresses, residential addresses, and loan records. The bank stated the incident will not materially impact its financial performance, business continuity, or core operations, noting that passwords, PINs, and transaction credentials were not compromised.
This confirmation follows claims from threat actors known as Cyberpulse56 and Siriusim, who alleged on October 16 and 19 that they had accessed 375,000 accounts, including thousands of PDF documents and CSV rows. While the cybersecurity account CyberPulse flagged these claims, it noted that the authenticity and extent of those specific allegations remained unverified.
In response to the confirmed breach, the bank activated its cyber incident response protocols and appointed an independent cybersecurity agency empanelled by the Indian Computer Emergency Response Team to investigate the source and scope of the exposure. Although funds are not directly at risk, the bank warned that the exposed personal information could be used by fraudsters for impersonation scams and targeted phishing.
