The State Bank of India (SBI), the country's largest public-sector lender, has disclosed a suspected data exposure after personal information linked to 3,897 customer records was identified in a much larger dataset circulating on the dark web.

In a filing to the Bombay Stock Exchange and National Stock Exchange on 21 October, SBI said it received alerts on 16 October from its threat-intelligence provider, the Defence Cyber Agency and CERT-In, India's cyber emergency response team. A preliminary review of about 375,000 records found online identified 3,897 containing personally identifiable information.

What was exposed

The exposed fields, according to the filing, included names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch and customer-information-file (CIF) numbers, lead IDs and metadata tied to loan or lead records. SBI says it does not yet know the source of the data, and has engaged an independent CERT-In-empanelled cybersecurity agency to establish its authenticity, extent and origin.

The bank says it activated its cyber incident response and containment protocols, that the incident has had no material impact on core operations, financial performance or business continuity, and that customer balances and funds remain safe. In a later update on 23 October, SBI said it had individually informed customers whose data was identified, by email and WhatsApp.

The main risk for affected customers is now targeted phishing: scammers armed with genuine personal details can make fraudulent calls and messages look convincing. Customers should never share one-time passwords, PINs or passwords, and should verify any unexpected contact claiming to be from the bank through official channels.

Source: Informist Media