State Bank of India (SBI) on Wednesday said a preliminary analysis identified 3,897 customer records containing personally identifiable information in data suspected to have been exposed on the dark web.
The bank has initiated a detailed investigation into the incident, news agency ANI reported.
SBI said it was alerted to the suspected exposure of customer data on the dark web through communications received on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In, the report further added.
The data reportedly contained a range of customer details, including names, dates of birth, gender, registered mobile numbers, email IDs and home addresses.
It also included branch details, customer information file (CIF) numbers, lead IDs, and metadata linked to loan and lead records, along with other related files.
Also Read: SBI raises concerns over proposed FCRA asset rules, says ‘clarity required’
As part of its preliminary analysis, the bank examined around 3,75,000 records found on the dark web and identified 3,897 customer records containing personally identifiable information (PII).
SBI activates cyber response protocols
The bank said it has activated its cyber incident response and containment protocols promptly after receiving the alert.
It has engaged an independent cybersecurity agency empanelled by CERT-In to carry out a comprehensive assessment and investigate the nature and extent of the alleged compromise.
The bank clarified that the incident has no material impact on its core business operations, financial performance or business continuity. Its core business functions continue to operate normally without disruptions, it added.
The Reserve Bank of India has repeatedly warned lenders about cyber risks that could threaten financial stability. Nearly one-third of the 43 banks and shadow lenders surveyed by the central bank reported a moderate or significant rise in cyber risks from a year earlier, Bloomberg reported.
(With inputs from agencies)