State Bank of India (SBI) on Wednesday assured customers that their account balances remain safe after a preliminary analysis identified 3,897 customer records containing personally identifiable information (PII) among data suspected to have been exposed on the dark web.
The Congress, however, criticised the country's largest public sector bank over the suspected exposure, saying SBI owed its customers answers and those responsible must be held accountable.
In a post on X, SBI said, "Customer balances are completely safe," adding that the incident had affected "a very very small number of customers". The bank also assured customers that it had taken steps to protect their interests.
According to SBI's regulatory filing, the bank received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about the suspected exposure of customer data on the dark web.
A preliminary analysis of approximately 3.75 lakh records available on the dark web identified 3,897 records containing PII. The information reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. The records also contained branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and other related files.
Reacting to the development, Congress media and publicity department head Pawan Khera said it was alarming that an external agency had alerted SBI to the suspected exposure.
"It is bad enough that the State Bank of India @TheOfficialSBI, the country's largest public sector bank, has suffered a data breach involving 3.75 lakh rows of data, with 3,897 records containing personally identifiable customer information," Khera said on X.
"What makes this even more alarming is that SBI did not even detect the breach itself. An external agency had to alert the bank that its customers' data had already been published on the dark web," he added.
Khera also alleged that SBI had yet to inform the affected customers.
"Now adding insult to injury, the SBI is yet to inform the very customers whose personal information it has failed to protect," he said.
"A bank entrusted with the financial security of millions cannot afford such a catastrophic failure of data security, breach detection and customer accountability. SBI owes its customers answers. Those responsible must be held accountable," Khera asserted.
SBI said it promptly activated its cyber incident response and containment protocols after receiving the alerts. It has also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the nature and extent of the suspected exposure.
The bank said the investigation would establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the risks to customers and the bank. The assessment is underway, and appropriate remedial and preventive measures are being implemented as required.
SBI further clarified that the incident had no material impact on its IT systems, core business operations, financial performance or business continuity. Its core functions continue to operate normally without disruption.
Reiterating its commitment to customer security, the bank said protecting customers' financial assets and data, as well as maintaining their trust, remained its highest priorities.
(With agency inputs from PTI and ANI)
