Industry Odisha Bureau, Oct 23: State Bank of India is studying the impact of a suspected data leak. It has alerted Oriental Insurance about its cyber cover. An independent investigation is under way. No payout has been confirmed.
State Bank of India has notified Oriental Insurance about a suspected customer data leak. The country’s largest lender is now assessing the impact and any potential losses. It may later seek compensation under a cyber insurance policy worth up to ₹1,425 crore.
The development was reported by The Economic Times, citing people familiar with the matter. Neither SBI nor the state-run insurer responded to requests for comment.
The ₹1,425-crore figure is the policy’s maximum coverage, not a confirmed loss. It does not indicate how much SBI may claim or receive. Any payout would depend on the policy’s terms and the nature of the incident. Only losses found eligible under the policy would qualify for compensation.
The incident came to light after a threat actor group reportedly posted data online. Around 375,000 rows of data and 2,722 PDF documents allegedly appeared on the dark web. A threat actor is a person or group behind malicious cyber activity. The dark web is a hidden corner of the internet linked to illicit trade.
SBI said it examined the records available on the dark web. The bank identified 3,897 customer records containing personally identifiable information. Such information can be used to identify individual people. The two figures should not be confused. Data rows do not necessarily correspond to individual customers.
The exposed details reportedly include names, mobile numbers, dates of birth and email addresses. Residential addresses and information linked to loan applications were also reportedly involved. The reported list does not mention passwords, banking credentials or account balances.
SBI has activated its cyber incident response procedures. Such procedures are typically pre-planned steps to contain and assess security incidents. The bank has also appointed an independent cybersecurity agency to investigate. The agency is empanelled by CERT-In, India’s nodal agency for cyber incidents. Empanelment means CERT-In has approved the firm for security audit work. The investigation remains ongoing. No findings on its cause or scale have been reported so far.
An insurance broker quoted in the report explained how such policies can work. A well-drafted cyber policy may cover certain liabilities linked to data protection law violations. Related expenses could also fall within its scope, depending on wording and applicable law. However, the broker noted that regulatory fines may face restrictions or exclusions.
Cyber insurance helps organisations transfer part of the financial risk from digital incidents. Policies usually cover only specified costs arising from incidents defined in the contract. Not every cyber-related loss is automatically insured.
For large banks, such cover forms part of broader operational risk management. Lenders hold large volumes of sensitive personal data, making protection a core priority. The suspected leak underlines the value of preparedness and swift incident response.
For now, key questions remain open. The investigation must establish the incident’s cause and full extent. Only then can SBI determine any eligible losses under its policy. Any eventual claim, and its size, will rest on those findings.
