New Delhi, 21 October (H.S.): The State Bank of India (SBI) has launched an investigation into the suspected exposure of customers’ personal information on the dark web, with a preliminary assessment identifying 3,897 records containing personal details. The bank said the incident had not significantly affected its core business operations and that all services continued to function normally.

SBI said a detailed assessment of the incident was underway and that corrective and preventive measures were being taken as required.

According to the bank, the records found to contain potentially exposed personal information included customers’ names, mobile numbers, email addresses, dates of birth and residential addresses. SBI first received an alert about the suspected data leak on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

In a regulatory filing to the stock exchanges on October 21, SBI confirmed that it had received the alert on October 16 regarding the possible exposure of its customers’ data on the dark web.

The bank said its preliminary analysis involved examining approximately 3.75 lakh records available on the dark web. Of these, 3,897 records were found to contain personally identifiable information (PII).

The information included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch details, Customer Information File (CIF) numbers, lead identification numbers and other metadata associated with loan and lead records.

SBI said a comprehensive investigation was necessary to establish the authenticity, completeness, potential source and extent of the exposed data, as well as to assess the associated risks to customers and the bank.

The bank initiated its cyber incident response procedures promptly to contain the incident and minimise its potential impact. It has also engaged an independent cybersecurity agency affiliated with CERT-In to investigate the nature of the incident and the suspected data exposure.

SBI said the assessment was continuing, with further corrective and preventive action to be taken based on the findings.

---------------

Hindusthan Samachar / Jun Sarkar