SBI data leak: What we know so far, and what it means for Indian residents in UAE

Dubai: State Bank of India (SBI) said on Wednesday that 3,897 customer records containing personal details were found exposed on the dark web, days after a hacker group claimed to be sitting on a much larger haul of the bank's data.

The disclosure, made in a filing to Indian stock exchanges, matters well beyond India. The UAE hosts one of the world's largest Indian communities: India's Ministry of External Affairs estimates about 4.34 million Indians live in the country, nearly all of them non-resident Indians (NRIs). Many still hold accounts, savings and loans with the state-owned lender.

The episode began on October 16, when a little-known group calling itself "Siriusim" said it had obtained confidential customer information allegedly linked to SBI. The cybersecurity monitoring account CyberPulse56 drew attention to the claim in a post on X.

According to that post, the group says it holds around 375,000 data entries in spreadsheet form, along with 2,722 PDF files. These allegedly include personal details, loan applications and account-opening documents.

SBI's response came on Wednesday. The bank said it had been alerted to the suspected exposure by three sources: its threat intelligence provider, India's Defence Cyber Agency and the national cyber response team, CERT-In.

A preliminary review of roughly 375,000 records found on the dark web identified 3,897 that contain personally identifiable information, SBI said. The bank's figure is a small fraction of the dataset the hackers advertised, and it is still verifying whether the records are authentic.

The exposed details reportedly include customers' names, registered mobile numbers, dates of birth, gender, email addresses and home addresses. Some records also carry internal references, such as branch and customer information file (CIF) identifiers, lead IDs, and background data tied to loan and lead records.

The bank has not listed passwords, PINs or one-time passwords (OTPs) among the leaked information, and no loss of customer funds has been reported.

SBI has not said whether any non-resident customers are affected. But because the leak includes loan-related data, NRIs who have applied for home or personal loans in India have reason to stay alert.

SBI said it moved quickly to trigger its cyber incident response and containment procedures. It has also brought in an independent cybersecurity firm, approved by CERT-In, to examine the nature and scale of the alleged compromise.

The investigation will try to establish whether the data is genuine and complete, where it came from, how far it spread, and what risks it poses. Remedial and preventive measures are already being put in place, the bank said.

SBI stressed that the incident has had no material impact on its core operations, financial performance or business continuity, and that its services are running without disruption.

Investors appeared unmoved. SBI shares were flat at about Rs970 (Dh37.5) on the BSE around 10am on Wednesday. The stock is down roughly 12 per cent over the past year, against a 52-week range of Rs891.55 (Dh34.5) to Rs1,234.80 (Dh47.8).

A leak of names and addresses rarely drains an account on its own. The danger lies in how fraudsters use it. A caller who already knows your birth date and home address can sound like a genuine bank officer, and then push for an OTP, UPI PIN or card number.