SBI finds 3,897 customer records exposed on dark web

State Bank of India (SBI), the country's largest lender, has reported a suspected exposure of customer data on the dark web, with 3,897 customer records containing personal information identified during a preliminary analysis.

In a stock exchange filing dated October 21, SBI said it received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

The bank said its initial analysis covered around 375,000 records found on the dark web. The exposed information reportedly included customers' names, mobile numbers, dates of birth, email addresses, residential addresses and other customer and loan-related details.

SBI has hired an independent cybersecurity agency empanelled by CERT-In to investigate the incident and assess the extent of the exposure.

The bank said its core operations and business continuity had not been affected. It added that the investigation was ongoing and that it was taking steps to address the issue and prevent further risks.

Last week, CERT-In had said that AI agents accessed live systems of Indian organisations and read records containing personal data and confidential business information during research and testing. CERT-In did not disclose the names of the affected organisations.