The State Bank of India (SBI) has issued a fresh update regarding a suspected data breach, confirming that it has individually notified customers whose personal information was identified during its preliminary investigation. The bank said alerts were sent through email and WhatsApp and reassured customers that their account balances and funds remain safe.
The development follows the discovery of nearly 3.75 lakh records on the dark web that were suspected to be linked to the incident. SBI’s initial investigation identified 3,897 customer records containing personal information, including names, mobile numbers, residential addresses and loan-related details.
The incident has raised concerns about the possible misuse of exposed customer information, although the bank has maintained that its banking operations and financial performance have not been materially affected.
SBI Confirms Notifications to Affected Customers
In its latest statement, SBI said it had contacted customers whose information was identified in the investigation through individual email and WhatsApp notifications.
The bank reiterated that customers’ account balances and funds remain safe. According to SBI, customers identified as affected during the preliminary investigation should have received a notification through at least one of these communication channels.
SBI has also stated that the incident has not had a material impact on its banking operations or financial performance. The investigation is continuing to establish the source and full extent of the suspected data exposure.
What Information Was Exposed in the SBI Data Breach?
According to SBI’s regulatory disclosure dated October 21, the bank received alerts about the suspected data exposure on October 16 from CERT-In, the Defence Cyber Agency and its threat intelligence provider.
The preliminary investigation identified 3,897 customer records containing personal information. The categories of information reported as exposed include:
- Customer names and dates of birth.
- Mobile numbers and email addresses.
- Residential addresses.
- Branch details and customer identifiers.
- Loan-related information.
SBI has stated that customer funds remain safe. However, the bank has appointed an independent cybersecurity agency to investigate the incident and determine its origin and scope.
Should SBI Customers Be Concerned?
The primary concern is the potential misuse of exposed personal information. Fraudsters could use details such as phone numbers, addresses and loan information to make fraudulent calls, emails or WhatsApp messages appear genuine.
Customers should remain cautious when receiving unexpected communications claiming to be from SBI. They should verify suspicious messages through the bank’s official channels and avoid clicking unknown links or sharing one-time passwords (OTPs), banking passwords or PINs.
Customers should also be careful about requests to disclose personal or financial information, even when a caller or message appears to know details about their banking relationship.
What Has SBI Said About Account Safety?
SBI has reassured customers that their account balances and funds are safe. The bank’s preliminary findings identified personal information in the exposed records, while the investigation into the incident’s full extent remains ongoing.
Customers who receive an official notification should follow the instructions provided and contact SBI through its verified customer service channels if they have concerns about their information.
The bank’s investigation is expected to help establish how the data became exposed and what further steps may be required.
Disclaimer
This article is intended for general informational purposes only and is based on the information provided about SBI’s reported cybersecurity incident. The investigation may reveal additional details or lead to revised findings. Customers should rely on official SBI communications for verified updates and contact the bank directly if they suspect fraudulent activity. This article does not constitute financial, legal or cybersecurity advice.