The State Bank of India (SBI) on Wednesday, October 21, disclosed a data loss incident involving the suspected exposure of customer data on the dark web. The bank said a preliminary analysis identified 3,897 customer records containing personally identifiable information (PII) among approximately 3.75 lakh records available on the dark web.
In a disclosure under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, SBI said it received communications on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In regarding an alert about the suspected exposure of customer data.
The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan and lead records, along with related files.
SBI said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.
The bank said it promptly activated its cyber incident response and containment protocols. It also engaged an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise.
SBI said the incident had no material impact on its core business operations, financial performance or business continuity. The bank’s core business functions continue to operate normally without disruptions, it added.
The bank said a detailed assessment was underway and appropriate remedial and preventive measures were being implemented as required. It also said it would continue to monitor the situation and take appropriate measures in accordance with applicable regulatory requirements.