SBI Assures Customers: Balances Safe Despite Dark Web Data Exposure
State Bank of India clarifies that account balances are safe after personally identifiable information of some customers appeared on the dark web.
The State Bank of India (SBI) has stepped forward to calm its massive customer base after reports emerged that some user data had been exposed on the dark web. In a swift response, the bank has assured the public that account balances remain completely safe and that the breach has impacted only a "very very small number of customers."
How the Breach Was Discovered
The situation came to light on October 16, when SBI received critical alerts from several high-level security entities. These included the bank's own Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). The alerts warned of suspected customer data being circulated on the dark web, prompting an immediate internal investigation.
The Scale of the Exposure
To understand the extent of the leak, SBI conducted a preliminary analysis of approximately 3,75,000 records found on the dark web. Out of this massive dataset, the bank identified 3,897 customer records that contained personally identifiable information (PII).
The exposed data reportedly includes sensitive personal details such as:
- Registered mobile numbers
- Full names and gender
- Dates of birth
- Email addresses and residential addresses
- Branch and Customer Information File (CIF) identifiers
- Lead IDs and metadata associated with loan and lead records
SBI's Response and Containment Strategy
Upon receiving the alerts, SBI immediately activated its cyber incident response and containment protocols. To ensure a transparent and thorough investigation, the bank has engaged an independent cybersecurity agency empanelled by CERT-In. This agency is tasked with conducting a comprehensive assessment to determine the exact nature and extent of the compromise.
The ongoing investigation aims to achieve three primary goals:
- Establish the authenticity and completeness of the data found on the dark web.
- Identify the potential source of the exposure.
- Assess any remaining risks to the bank and its customers.
Business Operations Remain Unaffected
Addressing concerns regarding the bank's stability, SBI clarified that this incident has had no material impact on its core business operations, IT infrastructure, or financial performance. The bank emphasized that its core functions continue to operate normally without any disruption to services.
"Customer balances are completely safe," the bank stated in a post on X, reiterating that the safety of financial assets and customer trust remains its highest priority.
As the assessment continues, SBI has stated that it is implementing the necessary remedial and preventive measures to safeguard its systems and protect the interests of its customers.