SBI Data Leak: Probe Demanded After 3,897 Customer Records Found

Concerns over the security of customer data at State Bank of India have intensified after CPI(M) Rajya Sabha member A.A. Rahim called on the Union Finance Minister to order a independent investigation. Rahim made the demand on Thursday, citing reports that SBI customer information was found on the dark web.

The reports say SBI has identified 3,897 customer records containing personal identification details in the compromised dark web data. Rahim has asked the government to determine how the data was exposed and how widely it has been shared.

According to the reports, SBI received alerts on October 16 from a threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). An independent cyber security firm has since been assigned to probe the incident.

The data types reportedly involved include customer names, registered phone numbers, dates of birth, email addresses, home addresses, branch details, CIF identifiers and metadata tied to loan and lead records.

Rahim warned that such information in the wrong hands could enable identity theft, targeted phishing, impersonation and financial fraud. He singled out pensioners, workers, small traders and other vulnerable groups as those who could suffer the most.

He rejected the idea that uninterrupted banking services offset the seriousness of a personal data leak. SBI has stated that the incident has had no major impact on its core operations or business continuity.

The Rajya Sabha member requested a defined timeframe for the investigation and easy-access channels for customers to report suspected fraud. He also asked for full disclosure of findings and corrective actions.

Rahim extended his demands to the wider banking sector, urging the Finance Ministry to review cybersecurity across all public sector banks, strengthen real-time threat detection and data access controls, and hold those responsible accountable for negligence.

The letter emphasises that public sector banks have a duty to safeguard customer privacy even when their main banking systems operate normally. The full extent and source of the suspected data leak remain under investigation.