SBI confirms 3,897 customer records in alleged 375,000-record dark web leak claimed by Siriusim

Linha do tempo

1. thehackernews.com ↗ · pub. 21/10/2026 04:44 · coletado 21/10 05:00

   State Bank of India confirms data loss after 3,897 customer records appear in alleged 375,000-record dark web leak

   ler a análise desta fonte ocultar

   State Bank of India (SBI) disclosed in an October 21 stock-exchange filing that it had identified 3,897 customer records containing personal information within a set of about 375,000 records circulating on the dark web. The bank says it does not yet know where the data came from or whether it is authentic. The alert reached SBI on October 16 via its threat intelligence provider, CERT-In and the Defense Cyber Agency. The bank activated incident response and containment and engaged an independent auditor from CERT-In's empanelled panel. It reports no material impact on core operations. The filing names no attacker, but the 375,000 figure matches a claim by a threat actor using the name Siriusim, flagged on X by the monitoring account CyberPulse56 on October 16.

   Technical Details

   • Exposed categories per the filing: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata tied to loan/lead records and related files.
   • Not listed in the filing: account numbers, balances, passwords, OTPs, card details, and PAN or Aadhaar numbers.
   • Siriusim claims 375,000 CSV rows and 2,722 PDF documents (loan applications, supporting documents, account-opening forms, addresses), listed on BreachForums.
   • The Free Press Journal reviewed 4 sample records. The phone numbers were valid, and a WhatsApp profile photo matched the photo on a posted KYC document. This verifies only 4 records, not the full set or its origin.
   • The samples were mostly loan-related with KYC fields. It is unclear whether the data belongs to SBI, a subsidiary, or a third-party provider.
   • The filing does not link its analysis to the listing, does not say whether the 2,722 PDFs were examined, and gives no date for when the data first appeared. Whether any SBI system was breached remains open.
   • The main risk is impersonation and social engineering using the combination of name, mobile number, DOB, address, branch and internal ID.
   • For comparison, Bank of Baroda made a similar filing on July 27 and cited potential business email compromise as a preliminary cause. SBI cites none.

   Remediation

   • The filing says nothing on customer notification. SBI's general guidance is to report cyber incidents to [email protected] or the national cybercrime helpline 1930.
   • Customers should treat unsolicited calls or messages that cite personal or loan details as suspect.
   • Defenders should monitor for phishing and vishing that impersonate SBI.
2. gbhackers.com ↗ · pub. 20/10/2026 02:06 · coletado 20/10 03:00 primeiro registro

   Threat actor Siriusim claims leak of State Bank of India customer data: 375,000 CSV rows and 2,722 PDFs, unverified

   ler a análise desta fonte ocultar

   A threat actor calling itself Siriusim allegedly leaked customer information and documents tied to the State Bank of India (SBI), according to a CyberPulse post dated October 16, 2026. The claimed dataset has 375,000 CSV rows and 2,722 PDF documents. Its authenticity, origin and scope are unverified, and the row count does not equal the number of unique affected customers. Siriusim says the material includes personal customer data, loan applications, supporting documents, account-opening applications and addresses, and describes the release as the dataset's first disclosure. SBI has not confirmed the claim, and the article reports no investigation or breach notification by the bank.

   Technical Details

   • The described contents point to exposed application records, not a confirmed compromise of transaction-processing systems.
   • The source does not identify the systems that held the data, how it was obtained, or whether it came directly from SBI infrastructure.
   • There is no intrusion timeline, exploited vulnerability, malware or technical indicator. Attributing the leak to ransomware, credential theft or an exposed database would be premature.
   • There is no evidence that account balances, passwords or payment credentials were exposed, or that customer accounts were accessed or unauthorized transactions made.
   • If genuine, the data could enable identity theft, targeted phishing, financial fraud and fraudulent loan applications. CyberPulse presents these as potential risks, not confirmed outcomes.

   Remediation

   • CyberPulse urged SBI to investigate the claim, determine whether customer records were exposed, and notify potentially affected individuals through official channels.
   • Validation would require establishing the records' provenance, confirming the link to SBI, counting unique customers, and checking whether the PDFs overlap with the CSV records.