INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

State Bank of India Experiences Customer PII Data Breach Incident

| 2026-10-23 03:30 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 23, 2026, the State Bank of India (SBI) suffered a customer PII data leak, with potentially serious consequences for thousands impacted. The breach was attributed to an anonymous hacker who leaked sensitive records from SBI, including names, genders, mobile numbers, email addresses, home addresses, dates of birth, bank profile IDs, metadata associated with loans, and other files. A total of 3,897 customer records were leaked online, although it is unclear why the breach affected only a small fraction of the bank's customers - approximately 0.0008% of its 500 million+ clients. The attack likely worked by exploiting vulnerabilities in SBI's systems or through social engineering tactics, but the exact method remains unknown. As of now, SBI has acknowledged the incident and is taking steps to mitigate the consequences for those affected, including providing support to impacted customers.
Technical Mitigations AI-generated
• Patch the SBI Quick system, which was vulnerable to a breach in 2019. • Implement robust password protection for all servers and data centers used by SBI. • Use techniques such as data encryption and secure storage to protect sensitive customer information.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
LATAM LATAM financefinance
Incident Timeline
‎2026/09/23
Threat actors used a Telegram bot and API platform to sell personal records of State Bank of India customers for approximately 5 rupees per lookup.
target_region India
Last month, his team reported on an Indian data broker selling personal records for only about 5 rupees (6 cents or so) per lookup, through a Telegram bot and business application programming interface (API) platform.
organisation API
Last month, his team reported on an Indian data broker selling personal records for only about 5 rupees (6 cents or so) per lookup, through a Telegram bot and business application programming interface (API) platform.
general_metric 5 rupees
Last month, his team reported on an Indian data broker selling personal records for only about 5 rupees (6 cents or so) per lookup, through a Telegram bot and business application programming interface (API) platform.
general_metric 6 cents
Last month, his team reported on an Indian data broker selling personal records for only about 5 rupees (6 cents or so) per lookup, through a Telegram bot and business application programming interface (API) platform.
‎2026/10/16
A customer's personally identifiable information was leaked from the State Bank of India after a new account on BreachForums published sensitive details about an individual who had recently applied for a loan.
target_region India
State Bank of India Leaks Customer PII Last week, a new account with the name "Siriusim" published a post to the mainstream data breach website BreachForums.
tactic Data Breach
State Bank of India Leaks Customer PII Last week, a new account with the name "Siriusim" published a post to the mainstream data breach website BreachForums.
organisation State Bank of India Leaks
State Bank of India Leaks Customer PII Last week, a new account with the name "Siriusim" published a post to the mainstream data breach website BreachForums.
organisation BreachForums
State Bank of India Leaks Customer PII Last week, a new account with the name "Siriusim" published a post to the mainstream data breach website BreachForums.
‎2026/10/23
An anonymous hacker leaked a small batch of sensitive customer records from the State Bank of India, containing potentially serious consequences for approximately 3,897 impacted customers.
organisation State Bank of India Suffers
State Bank of India Suffers a Customer PII Data Leak.
organisation the State Bank of India
An anonymous hacker has leaked a small batch of sensitive customer records from the State Bank of India (SBI), with potentially serious consequences for the thousands impacted.
organisation SBI
An anonymous hacker has leaked a small batch of sensitive customer records from the State Bank of India (SBI), with potentially serious consequences for the thousands impacted.
organisation National Stock Exchange
In a notice to India's National Stock Exchange, the organization's compliance and company secretary acknowledged that 3,897 customer records had been leaked online.
data_breach 3,897 customer records
In a notice to India's National Stock Exchange, the organization's compliance and company secretary acknowledged that 3,897 customer records had been leaked online.
organisation Free Press Journal
Mumbai's Free Press Journal verified that PII from the breach samples was valid, belonging to real Indian citizens.
organisation Russian Influence Operation Widely Targets
" Related: Russian Influence Operation Widely Targets Latin America For a bank that serves north of 500 million people , a few thousand records does indeed qualify as very, very small.
organisation PII
Cyber experts note, though, that for those affected, the consequences could be significant thanks to India's sophisticated underground economy for buying and selling personally identifying information (PII).
organisation Cyber Protector
Captain Y from SBI is "your Cyber Protector," he says in his promo video, "with awareness as his superpower."
organisation PDF
The data included a table with 375,000 rows, and 2,722 PDF files.
data_breach 2,722 PDF files
The data included a table with 375,000 rows, and 2,722 PDF files.
organisation Siriusim
As part of the post, Siriusim featured a few documents with handwritten personal information.
organisation KYC
One individual, for example, lost their mobile number and know your customer (KYC) documentation in the breach, and the WhatsApp photograph associated with their number matched the passport photo included in the KYC file.
organisation WhatsApp
One individual, for example, lost their mobile number and know your customer (KYC) documentation in the breach, and the WhatsApp photograph associated with their number matched the passport photo included in the KYC file.
organisation Bhardwaj
For instance, "KYC details are hard to change, so they can support identity fraud, such as applying for credit in someone else’s name or answering account-verification questions," Bhardwaj notes.
organisation OTP
And with regard to loan metadata, "a caller who can quote real loan details can pose as the bank or a recovery agent and pressure a borrower into paying a 'fee' or sharing a one-time password (OTP).
organisation Cyderes
" Brian Hussey, senior vice president for Cyderes' Howler Cell, goes deeper.
organisation Hussey
And data breaches like SBI's, Hussey notes, can feed into this underground economy.
victims 3,897 individual customers
They did not specify whether those records belonged to 3,897 individual customers.
Tactical Metrics
Metrics
data_breach
3,897
Customer Records
In a notice to India's National Stock Exchange, the organization's compliance and company secretary acknowledged that 3,897 customer records had been leaked online.
Metrics
data_breach
2,722
Pdf Files
The data included a table with 375,000 rows, and 2,722 PDF files.
Metrics
victims
3,897
Individual Customers
They did not specify whether those records belonged to 3,897 individual customers.
Intelligence Sources
Dark Reading 2026-10-23