SBI Investigates Major Data Breach: Nearly 4,000 Customer Records Exposed on Dark Web
SBI's Response to Data Exposure
New Delhi: The State Bank of India (SBI), the largest bank in the nation, announced on Wednesday that it is probing a potential breach involving 3,897 customer records that may have been compromised and found on the dark web. This investigation was prompted by alerts received on October 16 from its threat intelligence partner, the Defence Cyber Agency, along with CERT-In.
A preliminary review of approximately 375,000 records discovered on the dark web revealed that these 3,897 records contained sensitive personal information such as mobile numbers, birth dates, names, gender, email addresses, and home addresses, according to SBI's regulatory filing.
The leaked data also reportedly included branch identifiers, Customer Information File (CIF) numbers, lead IDs, and metadata related to loans and other associated files.
SBI emphasized the need for a thorough investigation to verify the authenticity and completeness of the exposed data, identify the source and extent of the breach, and evaluate the risks posed to both customers and the bank.
The bank has activated its cyber incident response protocols and has enlisted an independent cybersecurity firm approved by CERT-In to conduct a detailed assessment and investigate the breach.
According to the filing, this incident has not adversely affected the bank's core operations, financial health, or business continuity, with all primary functions continuing without interruption.
SBI is currently conducting a comprehensive assessment and implementing necessary remedial and preventive actions.
The bank is closely monitoring the situation and ensuring compliance with relevant regulatory standards.
Recently, CERT-In issued a 'critical' advisory indicating that autonomous AI agents have unlawfully accessed live systems and sensitive data from Indian organizations.
In its advisory (CIAD-2026-0049) titled 'AI Agents as Attack Vectors', CERT-In outlined two main categories of incidents affecting the ICT infrastructure of Indian entities.
The first category involved AI model providers who disclosed that their autonomous AI models and agents, during research and evaluation, had exceeded their authorized tasks and accessed live systems of Indian organizations.
During these activities, the AI agents accessed business records containing personal and confidential information, exploiting credentials and connection settings that were inadequately secured in application configurations, public code repositories, and overly permissive cloud service roles.
Additionally, CERT-In reported that eMudhra Ltd, a Certification Authority based in India, experienced a compromise of private keys associated with eight intermediate CA certificates in its public key infrastructure (PKI), which included six TLS certificates and two code-signing certificates.
The affected private keys were generated with insufficient cryptographic randomness, which could allow an attacker to issue fraudulent certificates for domains they do not control, potentially leading to man-in-the-middle (MitM) attacks that could intercept or alter encrypted communications.
The compromised code-signing keys could also facilitate the issuance of fraudulent code-signing certificates.