SBI reports customer data exposure after much larger hacker claim

The story began with a claim by a hacker group calling itself Siriusim. On October 20, India News reported that the group claimed to have obtained State Bank of India customer data, involving 3.75 lakh records and 2,722 documents.

The authenticity and source of those alleged records had not been independently verified. Mint also reported the claim as unverified, a distinction that remains important even after SBI's subsequent disclosure.

On October 20, Times of India reported that cybersecurity monitoring account CyberPulse56 had highlighted the claim on X. That report described about 3.8 lakh data entries in CSV format, slightly different from the 3.75 lakh figure in other coverage. Neither figure was independently established.

On October 21, the story moved beyond the hacker's allegation. India Today reported that SBI had confirmed a cyberattack, with 3,897 customer records stolen and put on the dark web.

The bank's exchange filing provided a more qualified description of the findings. According to Business Line - Home, SBI reported suspected exposure of customer data and said its preliminary analysis had identified 3,897 records containing personally identifiable information.

Also on October 21, Bloomberg Technology reported that SBI had launched a probe after a suspected cyberattack exposed thousands of customer records containing personal information on the dark web.

The clearest bank-disclosed figure is 3,897 customer records identified during preliminary analysis, according to Business Line - Home. That is substantially smaller than the dataset Siriusim claimed to possess. The provided coverage does not establish whether the two refer to the same set of data or explain the gap.

The reports also differ in certainty. India Today describes confirmed theft, while Business Line - Home describes suspected exposure. Neither formulation independently validates the hacker group's larger claim or its alleged collection of PDF documents.

SBI's probe is the next concrete development to follow, according to Bloomberg Technology. The unresolved questions include the source and full extent of the exposure, and whether investigators can connect the 3,897 identified records to Siriusim's claims.

The contents of any authenticated leak will matter for customers. Mint reported that genuine sensitive customer records could potentially be misused for impersonation, phishing or identity theft. Those are conditional risks, not evidence that such misuse has occurred.