In a filing with stock exchanges on October 21, the country’s largest public-sector lender said a preliminary examination of around 3.75 lakh records available on the dark web had identified 3,897 records containing personally identifiable information.
The exposed information reportedly includes customers’ names, gender, registered mobile numbers, dates of birth, email addresses and residential addresses, along with branch details, Customer Information File (CIF) identifiers and metadata associated with loan and lead records.
SBI said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure.
The bank said it had activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency empanelled with CERT-In to investigate the matter.
In its exchange filing, SBI said the incident had no material impact on its business operations, financial performance or business continuity, adding that its core business functions continued to operate normally.
The bank said the investigation was ongoing to establish the authenticity and completeness of the exposed data, identify its possible source and determine the extent of the exposure.
The suspected leak does not necessarily mean that customers’ bank accounts have been hacked. The preliminary findings identify personal information and loan-related metadata, but do not establish that account passwords, PINs, transaction details or other banking credentials have been compromised.
Cybersecurity experts have cautioned that exposed personal information could nevertheless be misused to carry out targeted financial fraud. Fraudsters could use customers’ names, contact details and loan-related information to impersonate bank officials and make fraudulent calls or messages appear genuine.
Sarthak Dubey, Co-founder and COO of Mitigata, told NDTV that customer information could be exposed through systems beyond a bank’s core banking infrastructure, including loan-processing platforms, employee email accounts, shared drives and third-party service providers.
He said possible entry points could include compromised employee or vendor credentials, phishing, infostealer malware and incorrectly configured storage systems or application programming interfaces. However, he cautioned that investigators would need to establish whether the data originated from SBI’s systems, a third-party service provider or another source before drawing conclusions.
Dubey stressed that the risk extends beyond the exposure of personal information, as criminals could use such details to make fraudulent interactions appear legitimate.
He advised SBI customers to avoid sharing one-time passwords (OTPs), PINs or passwords with anyone, including callers claiming to represent a bank. Customers should also keep transaction alerts enabled, review account activity regularly and verify unexpected requests through official banking channels.
Account holders have also been advised to monitor their credit reports for unfamiliar loans, credit cards or credit enquiries and report suspicious transactions promptly. Those suspecting cyber fraud can contact India’s cybercrime helpline at 1930 or file a complaint through the official portal, cybercrime.gov.in.
Dubey said SBI’s response should focus on verifying the exposed data, identifying and containing the source of the leak, reviewing access permissions and third-party connections, and strengthening fraud monitoring for potentially affected customers.
SBI has said it will take appropriate remedial and preventive measures in line with applicable regulatory requirements as the investigation progresses.
For customers, the immediate priority is to remain vigilant against suspicious communications and independently verify requests involving banking information, without assuming that their accounts have been compromised solely because personal records may have been exposed.
Post a Comment
0 Comments