SBI says customer funds are safe, but questions remain over suspected data breach involving 3,897 accounts

New Delhi: State Bank of India (SBI) on Friday reassured customers that their money and account balances remain safe amid an investigation into a suspected cybersecurity breach involving the personal information of 3,897 customers found on the dark web.

The country’s largest lender said it had individually informed affected customers through email and WhatsApp and advised them to remain vigilant against potential fraud attempts.

Follow The PSUWatch Channel on Whatsapp

“We reiterate that your account balances and funds are safe with us,” SBI said in a post on X.

However, while the bank has ruled out any material disruption to its operations, the suspected exposure of sensitive personal information raises questions about customer data protection and the possibility of identity theft, phishing and other forms of financial fraud.

Nearly 3.75 lakh records examined

SBI disclosed on Wednesday that it had launched an investigation following cybersecurity alerts received on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

A preliminary examination of approximately 3.75 lakh records available on the dark web identified 3,897 customer records containing personally identifiable information.

The information included customer names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses.

The records reportedly also contained branch identifiers, Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan-related records.

Although the bank has not confirmed that its core banking systems were compromised, the presence of such information on the dark web raises concerns about how the data was accessed and whether weaknesses existed in the bank’s systems or associated platforms.

SBI informs affected customers

In its latest communication, SBI said it had contacted customers whose information was identified in the suspected exposure.

“Further to our earlier post regarding the recent cyber incident, the bank has individually informed all customers whose data was identified as involved, through email and WhatsApp,” the bank said.

Customers have been advised not to share one-time passwords (OTPs), PINs or banking passwords and to exercise caution while responding to unfamiliar calls, messages and emails.

However, the risk associated with exposed personal information extends beyond the immediate safety of bank balances.

Details such as mobile numbers, dates of birth and residential addresses can potentially be exploited by fraudsters to impersonate bank officials, conduct targeted phishing attacks or attempt identity-based scams.

Independent cybersecurity agency engaged

SBI said it had activated its cyber incident response and containment protocols immediately after receiving the alerts.

The bank has also engaged an independent cybersecurity agency empanelled by CERT-In to investigate the suspected compromise and conduct a comprehensive security assessment.

The investigation will seek to establish the authenticity and completeness of the exposed records, identify the possible source of the data and determine the full extent of the incident.

It will also assess potential risks to customers and the bank.

SBI maintained that the incident had not materially affected its core banking operations, financial performance or business continuity.

According to the bank, all essential services continue to function normally.

Customer funds may be safe, but what about personal data?

The distinction between the safety of customer deposits and the security of customer information is central to the incident.

While SBI has assured customers that their money is secure, this does not automatically eliminate the risks arising from possible exposure of personal information.

The bank has yet to establish how the records reached the dark web, whether the information originated from its internal systems or another source, and whether the identified records represent the full extent of the suspected exposure.

The incident also highlights the growing cybersecurity challenges facing financial institutions that hold vast amounts of sensitive customer information.

For a bank of SBI’s size, even a relatively limited exposure warrants scrutiny because compromised personal details can potentially be used in sophisticated fraud attempts.

Follow PSU Watch on LinkedIN

Investigation must establish accountability

SBI has said that appropriate remedial and preventive measures are being implemented while the detailed assessment continues.

However, the effectiveness of its response will ultimately depend on whether the investigation establishes the source of the suspected leak, identifies any security weaknesses and determines what additional safeguards are necessary.

Reassuring customers about the safety of their deposits is important, but it is only one part of the bank’s responsibility. Protecting their personal information, preventing its misuse and transparently explaining how a suspected exposure occurred are equally critical to maintaining public trust.

(PSU Watch is India's Business News centre that places the spotlight on PSUs, Bureaucracy, Defence and Public Policy. 👉 Click to join our channel now: PSUWatch WhatsApp Channel. Prefer LinkedIn? Follow PSU Watch on LinkedIN. Click to stay connected on Twitter here and stay updated.)