Skip to content
Hacker Posts

State Bank of India probes claim of 375,000 leaked records

A threat actor using the name Siriusim claims 375,000 SBI customer records on BreachForums. SBI says it is investigating an alleged incident; samples partly check out.

Published 3 min read
breachstate-bank-of-indiaindiadata-leak

A threat actor using the name Siriusim claims to be selling 375,000 customer records (CSV) plus 2,722 PDF documents tied to the State Bank of India (SBI) and its subsidiaries. The claim surfaced on BreachForums and was flagged on 16 October by the X account CyberPulse56. SBI says it is looking into an alleged incident. The data's origin — SBI's own systems, a subsidiary, or a third-party provider — is not established.

What is claimed

The listing reportedly contains loan applications, account-opening forms, customer identification (KYC) data, and residential addresses. Fields described across reporting include names, registered mobile numbers, dates of birth, gender, email and residential addresses, and internal branch/CIF identifiers. No account numbers, balances, passwords, OTPs, card data, or PAN/Aadhaar numbers are listed in the fields disclosed so far.

What is verified, and what isn't

The Free Press Journal reviewed public samples and found the phone numbers active and WhatsApp profile photos matching faces in the KYC documents — partial corroboration that does not confirm the full dataset or how it was obtained. In a stock-exchange filing dated 21 October, SBI said it "has experienced an incident involving the loss of certain data," referred to it as "the alleged compromise," and said there was "no material impact on the bank's core business operations," per reporting at The Hacker News. SBI reportedly identified 3,897 customer records within the larger set and engaged an independent cybersecurity firm; it has not said whether the 3,897 records map to 3,897 distinct people, nor whether its own systems were breached.

Two points to keep straight: the 375,000 figure is the actor's claim, independently sampled but not fully verified; the 3,897 figure is SBI's own count per its filing. Neither confirms a breach of SBI infrastructure.

Action checklist

  1. SBI customers: the concrete risk here is impersonation, not account takeover — someone with your name, number, date of birth, address, branch, and an internal ID can convincingly pose as the bank. Treat any inbound call or message referencing those details as hostile.
  2. The bank will not ask for OTPs, PINs, or full card numbers. Do not share them, however convincing the caller.
  3. Report suspected fraud to report.phishing@sbi.co.in or India's cybercrime helpline, 1930.
  4. Enterprises ingesting SBI-related data via partners: watch for the sample set circulating and for secondary phishing that reuses the leaked fields.

Context

This lands amid a run of claimed Indian financial-sector leaks sourced to BreachForums, where the hard part is separating a genuine breach from recycled or aggregated data dressed up as one. We are treating this as an alleged, partially corroborated leak until the source of the data is established — the sampled records look real, but "real records for sale" is not the same as "SBI was breached."

Related stories