SBI received alerts on October 16 from the Defence Cyber Agency and CERT-In about data allegedly listed on the dark web. A preliminary review of roughly 375,000 records found 3,897 containing confirmed customer PII, including names, mobile numbers, dates of birth, addresses, loan data, and branch identifiers. Hacker group Siriusim claims to hold around 375,000 CSV rows and 2,722 PDF documents linked to SBI. The bank has not confirmed the source or authenticity of the full dataset. An independent CERT-In-approved cybersecurity firm is now investigating.
What SBI Actually Confirmed
The regulatory filing uses precise, careful language. SBI says it “has experienced an incident involving the loss of certain data.”
It does not say SBI’s own systems were directly breached. It says customer records were found on the dark web. The bank reviewed approximately 375,000 records available there and identified 3,897 that contained real customer PII.
That’s roughly 1 record in every 100 reviewed. The bank has not confirmed whether those 3,897 records represent 3,897 different customers, or whether the remaining records in the dataset are genuine SBI data, recycled from other breaches, or fabricated.
The investigation will clarify the source and scope. For now, the 3,897 figure is what SBI has verified, not what the hacker claims.
What Was Exposed in Those 3,897 Records
According to the bank’s own statement, the exposed information reportedly includes:
- Full customer names
- Registered mobile numbers
- Dates of birth
- Gender
- Email addresses
- Residential addresses
- Branch identifiers and CIF (Customer Information File) numbers
- Lead IDs and metadata linked to loan or lead records
- Account-opening documents
The CIF number is worth noting specifically. It’s a unique identifier SBI uses to consolidate a customer’s full banking profile, every account, loan, and transaction history in one number. If a CIF is paired with a mobile number and address, it gives anyone holding that combination significant targeting ability for fraud or impersonation.
Loan-related metadata is also sensitive in ways that go beyond simple contact information. It reveals financial status, outstanding debt, and repayment history, exactly the profile that financial fraudsters use to make targeted calls appear legitimate.
This pattern mirrors what we covered in the Bank of Baroda breach earlier this year, where KYC records and loan documents exposed by TripleX created a similar risk: detailed financial profiles that make phishing calls extremely convincing to their targets.
Who Is Siriusim and What They Claim
The dark web listing was first flagged by cybersecurity monitoring account @CyberPulse56 on X on October 16, the same day SBI received official alerts from CERT-In and the Defence Cyber Agency.
CyberPulse56 reported that a threat actor using the name “Siriusim” had posted what it described as its “primary release” of SBI-linked data. The claim: approximately 375,000 rows in CSV format and 2,722 PDF documents containing customer details, loan applications, account-opening forms, and residential addresses.
Nothing in Siriusim’s claim has been independently verified. SBI has not confirmed the group accessed its systems directly, and the investigation is ongoing. As with many dark web breach claims, the data could be:
- Directly stolen from SBI systems
- Stolen from a third-party vendor or partner with SBI data access
- Assembled from multiple older breaches and misattributed
- Partially fabricated to inflate the claim’s apparent value
SBI’s own statement acknowledges this reality: “datasets like these are often compiled from information that’s become available through third-party data breaches, not our own records or systems.” This doesn’t minimize the exposure, it clarifies that a dark web listing doesn’t automatically mean a bank’s core infrastructure was penetrated.
The same question arose with the Australia Medicare dark web listing just weeks ago. In that case too, the government’s preliminary review found fabricated, mismatched, and real data in the same dataset, showing that threat actors routinely mix genuine and synthetic records to inflate the appearance of a breach.
How SBI Found Out and What It’s Done
The alert chain ran through two institutions: India’s Defence Cyber Agency, which provides cyber threat intelligence to critical national infrastructure, and CERT-In, the Indian Computer Emergency Response Team, which is India’s nodal agency for cyber incidents across government and critical sectors.
Both flagged the dark web exposure on October 16. SBI then conducted a preliminary review of the approximately 375,000 records and produced the 3,897 figure in time for the October 21 regulatory filing.
The bank has:
- Activated its cyber incident response and containment procedures
- Engaged an independent cybersecurity firm empanelled by CERT-In to assess the breach and investigate its scope
- Filed a formal disclosure with Indian stock exchanges (where SBI is listed)
- Confirmed the investigation will establish authenticity, determine the source, and assess risk
Notably, SBI disclosed this through a stock exchange filing rather than a direct customer notification. At time of writing, there is no public notification to individual customers whose records were confirmed in the 3,897.
Why Indian Banking Is Under Pressure in 2026
The SBI exposure lands in a context of sustained pressure on India’s financial sector. The ValueFirst messaging platform alert we covered earlier this year highlighted how India’s CPaaS infrastructure, which routes OTPs for banking authentication, had appeared in dark web intelligence monitoring. The Bank of Baroda breach exposed over 110,000 KYC files including Aadhaar numbers. And India’s broader digital infrastructure handles 18 billion+ UPI transactions monthly, making authentication data extraordinarily valuable to criminal actors.
The CRIF Cyber Observatory report from September 2026 found Italy ranking third globally for infostealer-stolen accounts, but India’s banking sector faces its own distinct threat profile: a large population of first-generation digital banking users, a mix of sophisticated and legacy IT infrastructure, and a mobile number that serves as the authentication hub for nearly every financial service.
SBI’s CIF numbers, mobile numbers, and loan metadata, if the dataset is genuine represent exactly the combination that enables OTP interception fraud at scale.
What SBI Customers Should Do Right Now
Until SBI confirms the source and scope, the safest assumption for any SBI customer is that basic precautions are warranted.
Watch for impersonation calls. Fraudsters with access to loan metadata, CIF numbers, branch details, and mobile numbers can call you and appear to know your full banking relationship. SBI will never ask for your OTP, net banking password, or card details over the phone. Hang up on any caller who does.
Don’t click links in SMS messages claiming to be from SBI. Phishing SMS campaigns often follow dark web data exposures, using real personal details to appear credible.
Check your registered mobile number in the SBI YONO app or net banking portal. If your number has been used to create fraudulent accounts elsewhere, early detection matters.
Report fraud immediately to cybercrime.gov.in or call 1930 India’s National Cyber Crime Reporting Portal handles financial fraud reports and can flag your accounts for additional monitoring.
For broader guidance on what to do when your personal data may have circulated online, our dark web data exposure guide covers the full sequence of protective steps.
Frequently Asked Questions
Did SBI get hacked directly?
SBI hasn’t confirmed that. The bank says customer data was found on the dark web and an investigation is underway to determine the source.
How many SBI customers are affected?
SBI has confirmed 3,897 records containing PII in a reviewed set of approximately 375,000 records. The hacker claims the full dataset is ~375,000 rows plus 2,722 PDFs.
Who is Siriusim?
A threat actor that posted what it calls a “primary release” of SBI-linked data on a dark web forum. No further identity information is publicly known.
What data was exposed?
Names, mobile numbers, dates of birth, email addresses, home addresses, CIF identifiers, branch details, loan metadata, and account-opening documents.
What is SBI doing about it?
It has activated incident response, hired a CERT-In-approved independent cybersecurity firm to investigate, and filed a regulatory disclosure.
