Four of about 3.75 lakh alleged records have been verified and the origin of the dataset is still unknown.
MUMBAI: A user on a cybercrime forum has claimed to hold customer records of the State Bank of India (SBI). Four samples posted as proof have checked out as real people. That is where the verified part ends. The remaining claim, about 3.75 lakh records and 2,722 PDF files, is unproven, and the bank has issued no statement as of 20 October. Notably, nothing so far shows that SBI’s core banking systems were breached.
On the record
On 16 October, a user on BreachForums advertised over 3.75 lakh rows in CSV format and 2,722 PDF files. The listing described loan applications, KYC documents, account-opening forms, addresses, CKYC and video KYC fields and employment declarations. The monitoring account CyberPulse56 flagged it on X the same day.
Subsequently, The Free Press Journal examined the four free samples. Phone numbers in them worked, and a WhatsApp profile picture tied to one number matched the passport photograph in the KYC document posted on the forum. The records belong to living individuals and carry full profiles, including dates of birth, nominees, branch details and income declarations. They contained application and KYC data, but no passwords or transaction credentials.
Still unproven
Authentic samples do not authenticate the rest. It is unknown whether the other 3,74,996 rows are genuine, outdated or stitched together from earlier leaks. Their age is unclear as well, so they may reflect old applications and not current accounts.
Origin is the biggest gap. The data could come from SBI’s core banking environment, but equally from a cloud storage bucket, a loan aggregator, a Direct Selling Agent or an onboarding vendor. No link to unauthorised transactions, SIM-swaps or identity theft has been shown. SBI has not answered media queries, CERT-In and the Reserve Bank of India have issued no public advisory, and no stock exchange disclosure has appeared. Silence, however, is neither confirmation nor denial.
In proportion
SBI has over 50 crore accounts and more than 22,000 branches, so 3.75 lakh records would be about 0.075% of its base. Some analysts read such a small slice as pointing to a narrower source, such as a regional loan processing centre or an external vendor. That remains an inference and not a finding.
Sector context cuts both ways. Bank of Baroda acknowledged in July an exposed database of about 1 TB, which shows that third-party and cloud configuration gaps affect public sector banks. It says nothing about the cause here.
Under the rulebook
If a bank identifies or is told of a real incident, several clocks start. CERT-In directions require reporting within six hours of awareness, even before forensics finish, and logs must be kept in India for 180 days. The RBI expects prompt reporting to its Cyber Security Cell through the DAKSH portal, a security operations centre running round the clock and a tested crisis plan.
Under the Digital Personal Data Protection Act, 2023, a bank must also notify the Data Protection Board and each affected person without undue delay. After an inquiry, penalties can reach ₹250 crore for weak safeguards and ₹200 crore for failing to notify. A material event also calls for exchange disclosure. These duties apply once a breach is established, so how the bank classifies the claim matters.
Banks face a real dilemma. Quick acknowledgement builds trust but may validate a dataset before forensics end. Silence protects the investigation, yet it can invite regulatory scrutiny. Threat actors also often use big names to sell old data or pressure for ransom.
For account holders
If the data is genuine, the main risks are targeted phishing that cites real application details and fraudulent loan applications built on KYC packages. SIM-swap attempts using name, date of birth and number are a further risk. So are scams such as the “jumped deposit”, in which small unsolicited credits precede requests for refunds. SBI warned about that scam this month.
Standard bank responses include resetting credentials, flagging profiles for transaction monitoring and tightening verification for changes. Customers should never share passwords, PINs or OTPs with callers. They should check any message through official branch channels and treat offers of a “breach remediation service” with suspicion.
Next to watch
Several signals will settle the matter. These include a stock exchange filing, a CERT-In bulletin, an RBI notice, a Data Protection Board inquiry and an FIR under the IT Act. Fresh forum posts, such as more samples or ransom demands, would also matter. The most useful answer will be the source of the records, whether SBI, a vendor or an older archive.
Encouragingly, India now has a clear framework for such incidents, with reporting duties, penalties and a dedicated Board. Ultimately, a statement from the bank will separate a verified sample from a verified breach.
About the Author
