State Bank of India (SBI) has reported a data-loss incident after receiving alerts about the suspected exposure of customer data on the dark web, with a preliminary analysis identifying 3,897 customer records containing personally identifiable information among around 3.75 lakh records examined.
In a disclosure to the stock exchanges on Wednesday, SBI said it received communications on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure.
The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and other related files.
The bank said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the risks to customers and the bank.
SBI said it had promptly activated its cyber incident response and containment protocols. It has also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise.
The bank said the incident had no material impact on its core business operations, financial performance or business continuity. Its core business functions continue to operate normally without disruption.
“A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required,” the bank said in its disclosure under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015.
SBI added that it was closely monitoring the situation and taking appropriate measures in accordance with regulatory requirements.
The bank has not disclosed the source of the suspected exposure or whether the investigation has established how the data became available on the dark web.