SBI flags potential data breach involving 3.75L customer records
What's the story
The State Bank of India (SBI), the country's largest lender, has flagged a potential data breach involving 3.75 lakh customer records. The information was found on the dark web and includes personally identifiable information (PII) such as names, mobile numbers, dates of birth and residential addresses. SBI has launched an incident response and hired an independent cybersecurity agency to investigate the alleged breach.
Investigation initiated
Suspected exposure detected on October 16
SBI received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In about the suspected exposure of customer data.
A preliminary analysis of some 375,000 records found on the dark web revealed these 3,897 customer records containing PII.
The bank said it was necessary to conduct a detailed investigation to confirm authenticity and completeness of exposed data.
Ongoing assessment
Exposed information includes customers' names, gender, email addresses
The exposed information includes customers' names, gender, registered mobile numbers, dates of birth, email addresses, residential addresses, branch and CIF identifiers.
It also includes lead IDs and metadata associated with loan/lead records, among other related files.
SBI has engaged an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive assessment and investigate the nature and extent of this alleged compromise.
Business continuity
No material impact on core business operations
Despite the data breach, SBI has assured that there is no material impact on its core business operations, financial performance or business continuity.
The bank said in its filing that "the Bank's core business functions continue to operate normally without disruptions."
SBI is closely monitoring the situation and will take necessary actions as per applicable regulatory requirements.