State Bank of India is investigating a suspected data breach after 3.75 lakh records surfaced on the dark web. The bank got alerted on October 16 and started a probe. "A detailed investigation was required to establish the authenticity," the bank said. Many customer records showed personal details were exposed.
State Bank of India is investigating a suspected data breach involving approximately 3.75 lakh records found online. The bank has engaged cybersecurity experts to assess the extent and risks related to the exposed data. Preliminary analysis has identified nearly 3,900 customer records, which include personally identifiable information. Previously, Central Bank of India experienced a technical glitch affecting its systems but reported no financial losses.
State Bank of India is investigating a suspected data breach after around 3.75 lakh records linked to the country's largest lender surfaced on the dark web, the latest cyber incident to hit the financial sector at a time when India's cybersecurity agency has warned that attackers are increasingly using artificial intelligence to accelerate attacks on financial institutions.
The bank was alerted on October 16 by its threat-intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about the suspected exposure of customer data, the lender said in an exchange filing.
SBI said it immediately activated its cyber-incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to investigate the nature and extent of the suspected compromise.
"A detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank," SBI said in an exchange filing Wednesday.
SBI said preliminary analysis of approximately 375,000 records available on the dark web identified 3,897 customer records containing personally identifiable information (PII). The exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email and residential addresses, branch and customer information file (CIF) identifiers, lead IDs and metadata associated with loan and lead records.
The lender said the incident has not had any material impact on its core business operations, financial performance or business continuity, with operations continuing normally.
The disclosure comes just two days after
Central Bank of India reported a technical glitch in its RTGS outward system between October 15 and October 17, following which it shut down and isolated the affected systems and brought in external experts to investigate the root cause. The state-owned lender said no customer suffered any financial loss and has so far not attributed the incident to a cyberattack.
The two disclosures come against a series of warnings from CERT-In over increasingly sophisticated attacks on Indian financial and technology infrastructure. On October 15, the agency issued a critical advisory on the use of AI agents as attack vectors, saying it had observed incidents where AI agents either exceeded their authorised tasks and accessed Indian systems or were deliberately deployed by attackers for reconnaissance, exploitation and financially motivated intrusions.
CERT-In said agentic AI tools had in some cases compressed the period between initial compromise and final impact from days to a few hours, while allowing attackers to conduct multiple operations simultaneously. However, it stressed that the underlying vulnerabilities remained conventional -- including exposed credentials, dormant or test APIs, plaintext payment-API keys, permissive cloud access and internet-facing management systems with weak authentication.
Earlier, on October 9, CERT-In and CSIRT-Fin had issued another critical advisory after detecting multiple cyberattack campaigns targeting NBFCs, digital lenders, fintechs, payment service providers and wallet operators. Attackers were found compromising internet-facing applications and APIs, stealing payment aggregator and partner-bank credentials, and directly invoking fund-transfer and disbursement APIs.
The attacks were capable of bypassing normal controls including loan creation, KYC, beneficiary verification, sanction checks and transaction limits, with funds transferred through IMPS and NEFT to mule accounts. CERT-In said its analysis also indicated possible use of AI-assisted offensive tools, with the time between compromise and fraudulent transfers shortening significantly in recent incidents.