SBI data breach claim: Cyber agencies evaluate alleged leak of 3.75 lakh records

What happened

Cybersecurity agencies and financial authorities are evaluating claims made by an anonymous threat actor alleging access to records linked to State Bank of India customer accounts.

The hacker group, identifying itself as Siriusim, posted on the dark web forum BreachForums that it holds data covering 3.75 lakh account records along with 2,722 PDF documents. The assertion was highlighted publicly on October 16 by cybersecurity monitoring account CyberPulse56 on X.

SBI has not issued a formal statement on the matter, and security researchers stress that the authenticity, origin, and currency of the dataset remain completely unverified.

What records are involved in the claim

The hacker group published four sample customer records alongside its post, asserting that the full repository contains personal application information and Know Your Customer documentation.

Security analysts emphasize that unverified data dumps on cyber forums often involve recycled records from legacy leaks, third-party vendor systems, or aggregated marketing databases rather than direct breaches of central core-banking systems. Indian public sector lenders maintain stringent operational cybersecurity protocols under Reserve Bank of India guidelines, including continuous security operations monitoring and encrypted data stores.

Potential risks and official response

If any portion of the dataset is confirmed to be authentic, experts warn that exposed contact details and application forms could be used by financial fraudsters for targeted phishing, identity misuse, or fraudulent credit queries.

Security protocols recommend that banking users remain vigilant against unverified phone calls, SMS prompts, or emails claiming to represent financial institutions. SBI and regulatory threat monitoring channels routinely conduct audit reviews to ensure system integrity and safeguard user accounts against external digital threats.

Technical specialists continue to analyze the dark web postings to establish whether any genuine customer information was compromised.