SBI investigating suspected exposure of 3,897 records

State Bank of India said it had identified 3,897 records containing personal information among approximately 375,000 records found online, and is investigating a suspected exposure of customer data. In a stock-exchange filing on October 21, the bank said its preliminary review followed alerts received on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, or CERT-In. The bank said the records included personally identifiable information. Reported categories include names, mobile numbers, dates of birth, email addresses and residential addresses, along with branch or customer identifiers and metadata related to loan and customer lead records. SBI has not established the dataset’s complete contents, authenticity or source. The figure of approximately 375,000 refers to the records SBI reviewed online, not a confirmed count of affected customers. The bank’s preliminary assessment identified 3,897 records containing personal information. A threat actor using the name Siriusim reportedly claimed to possess a larger collection, but that claim has not been independently verified, and SBI has not attributed...