3,897 Customer Records Leaked; SBI Confirms Funds Untouched

Country's largest lender SBI has confirmed that the personal data of 3,897 customers has been leaked and published on the dark web, but insisted that none of the funds held in customer accounts have been affected. The clarification was issued on Friday in New Delhi.

SBI said on X that it had already informed all customers whose data was compromised through separate notices sent by email and WhatsApp. The bank reaffirmed that customer balances and funds are safe.

The bank also urged account holders to remain vigilant. Customers were asked to keep their OTP, PIN, and password confidential and to treat unexpected calls, messages, or emails with caution.

Earlier this week, the bank had disclosed that a data leak had occurred. Its initial analysis of nearly 3,75,000 records available on the dark web revealed 3,897 customer records containing personally identifiable information.

The bank said it had received an alert from its threat intelligence service provider, the Defence Cyber Agency, and CERT-In regarding the possible leak of customer information.

According to SBI, the exposed details include registered mobile numbers, dates of birth, names, gender, email IDs, residential addresses, branch and CIF identifiers, lead IDs, metadata related to loan or lead records, and other relevant files.

The bank has activated its cyber incident response and containment protocols immediately. It has also appointed an independent cybersecurity agency accredited by CERT-In to carry out a broader investigation into how the leak occurred and how far it extends.

The bank said the ongoing probe aims to verify the authenticity and completeness of the leaked data, determine its likely source and scope, and assess the risks arising from it.