INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

State Bank of India Exposes 3,897 Customer Records Online

| 2026-10-21 07:44 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
The State Bank of India confirmed a data leak on October 21, where approximately 3,897 customer records containing personal information were found on the dark web. The bank's largest state-owned entity did not specify who is behind the incident or how it occurred; however, an independent cybersecurity firm was engaged to assess what was described as "the alleged compromise." These leaked records included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records. The bank has not established whether the data is authentic or poses a risk to its 3,897 affected customers; it remains uncertain how far the exposure goes.
Technical Mitigations AI-generated
• Block or hunt for the Siriusim username and any associated threat actor on cybercrime forums like BreachForums. • Use a threat intelligence provider's monitoring account, such as CyberPulse56, to detect potential data leaks in real-time. • Verify phone numbers by checking KYC documents and passport-size photographs posted online to identify genuine records.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
IN
defensedefense financefinance governmentgovernment
Incident Timeline
‎July 27
Bank of Baroda told the exchanges on July 27 about a cyber-security incident after receiving a communication from an anonymous source claiming access to certain data.
organisation Bank of Baroda
Bank of Baroda, another state-owned bank, told the exchanges on July 27 about a cyber-security incident in nearly the same words, including "the alleged compromise," after receiving "a communication from an anonymous source claiming access to certain data."
‎October 16
Threat actors posted approximately 375,000 customer records on the dark web.
target_region India
The alert reached the bank on October 16 via its threat intelligence provider, CERT-In, India's national computer emergency response team, and the Defense Cyber Agency, the armed forces' cyber agency under the Ministry of Defense.
attribution CERT-In
The alert reached the bank on October 16 via its threat intelligence provider, CERT-In, India's national computer emergency response team, and the Defense Cyber Agency, the armed forces' cyber agency under the Ministry of Defense.
organisation the Defense Cyber Agency
The alert reached the bank on October 16 via its threat intelligence provider, CERT-In, India's national computer emergency response team, and the Defense Cyber Agency, the armed forces' cyber agency under the Ministry of Defense.
organisation the Ministry of Defense
The alert reached the bank on October 16 via its threat intelligence provider, CERT-In, India's national computer emergency response team, and the Defense Cyber Agency, the armed forces' cyber agency under the Ministry of Defense.
general_metric 375,000 matches
The figure of about 375,000 matches a claim that the monitoring account CyberPulse56 flagged on X on October 16.
‎October 21
State Bank of India confirmed a data leak after discovering 3,897 customer records on the dark web.
target_region India
The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain data."
‎2026/10/21
Threat actors using the name Siriusim claimed to have leaked customer documents and personal data linked to State Bank of India.
organisation State Bank of India Confirms Data Leak
State Bank of India Confirms Data Leak
organisation State Bank of India
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.
data_breach 3,897 customer records
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.
After 3,897 Customer Records Found on Dark Web.
The bank has not said whether the 3,897 records belong to 3,897 different people, or what the rest of the set contains.
data_breach 375,000 records
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.
organisation Customer Records Found
After 3,897 Customer Records Found on Dark Web.
organisation CIF
The exposed information "reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files," in the filing's words.
organisation PAN
Account numbers, balances, passwords, one-time passcodes, card details and government identity numbers such as PAN or Aadhaar are not among the categories the filing lists.
organisation Aadhaar
Account numbers, balances, passwords, one-time passcodes, card details and government identity numbers such as PAN or Aadhaar are not among the categories the filing lists.
organisation Siriusim
The account said a threat actor using the name Siriusim claimed to have leaked customer documents and personal data linked to SBI: 375,000 rows in CSV format and 2,722 PDF documents, said to include personal information, loan applications and supporting documents, account-opening forms and addresses.
organisation SBI
The account said a threat actor using the name Siriusim claimed to have leaked customer documents and personal data linked to SBI: 375,000 rows in CSV format and 2,722 PDF documents, said to include personal information, loan applications and supporting documents, account-opening forms and addresses.
organisation CSV
The account said a threat actor using the name Siriusim claimed to have leaked customer documents and personal data linked to SBI: 375,000 rows in CSV format and 2,722 PDF documents, said to include personal information, loan applications and supporting documents, account-opening forms and addresses.
organisation PDF
The account said a threat actor using the name Siriusim claimed to have leaked customer documents and personal data linked to SBI: 375,000 rows in CSV format and 2,722 PDF documents, said to include personal information, loan applications and supporting documents, account-opening forms and addresses.
organisation The Free Press Journal
The Free Press Journal examined the listing on BreachForums, a cybercrime forum used to trade stolen data, and found 4 sample records posted with the listing.
organisation BreachForums
The Free Press Journal examined the listing on BreachForums, a cybercrime forum used to trade stolen data, and found 4 sample records posted with the listing.
data_breach 4 sample records
The Free Press Journal examined the listing on BreachForums, a cybercrime forum used to trade stolen data, and found 4 sample records posted with the listing.
That check covers 4 records and does not show that the whole set is genuine or where it came from.
organisation WhatsApp
The WhatsApp profile picture on one number matched the passport-size photograph on that person's KYC document, which the actor had also posted.
organisation KYC
The WhatsApp profile picture on one number matched the passport-size photograph on that person's KYC document, which the actor had also posted.
Tactical Metrics
Metrics
data_breach
3,897
Customer Records
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.
After 3,897 Customer Records Found on Dark Web.
The bank has not said whether the 3,897 records belong to 3,897 different people, or what the rest of the set contains.
Metrics
data_breach
375,000
Records
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.
Metrics
data_breach
4
Sample Records
The Free Press Journal examined the listing on BreachForums, a cybercrime forum used to trade stolen data, and found 4 sample records posted with the listing.
That check covers 4 records and does not show that the whole set is genuine or where it came from.
Intelligence Sources
The Hacker News 2026-10-21