Industry Odisha Bureau, Oct 20: A hacker group claims to hold data on 3.75 lakh SBI customer accounts. The claim, flagged on X, remains unverified, and the bank has yet to comment.
A hacker group claims to hold data on 3.75 lakh SBI customer accounts. State Bank of India (SBI) is the country’s largest lender. Cybersecurity account CyberPulse56 flagged the claim on social media platform X. The Economic Times reported the development on 20 October.
The group, called Siriusim, says its dataset covers over 3,75,000 accounts and 2,722 PDF files. According to CyberPulse56, the material includes personal customer details and loan applications. It also reportedly contains supporting documents, account-opening forms and residential addresses. Other application-related records are said to be included as well. “The threat actor describes this as the first disclosure of the dataset,” CyberPulse56 said.
Crucially, the claim has not been independently verified. CyberPulse56 itself said the authenticity, origin and extent of the alleged exposure remain unconfirmed. It is unclear whether the data is new or previously circulated. Holding customer records is also different from gaining access to a bank’s core systems. Only technical verification can establish whether any genuine breach occurred, and how large it is.
SBI had not responded to The Economic Times’ emailed query by press time. An official statement would clarify whether any incident took place. It could also show whether SBI systems or third-party platforms were involved. Customers would also learn whether they need to take protective steps.
If genuine, the data could carry real risks for customers. CyberPulse56 warned it could enable identity theft, financial fraud and targeted phishing. Fraudsters might also use such documents to file fake loan applications. Addresses and personal details can make scam calls sound convincing. This tactic, called social engineering, tricks people into revealing passwords or one-time codes. There is, however, no report that customer funds or banking credentials were compromised.
The claim lands as Indian banks expand digital services at speed. Lenders now hold vast volumes of sensitive customer information. That makes strong data security, vendor oversight and rapid incident response essential. Any verified breach can also damage public trust in a bank.
India’s framework sets several duties for lenders. The Reserve Bank of India requires banks to maintain cybersecurity and information-security controls. The Computer Emergency Response Team (CERT-In) requires reporting of specified cyber incidents. The Digital Personal Data Protection Act, 2023, adds obligations as its rules are phased in. Whether any apply here depends on whether an incident is confirmed.
Meanwhile, customers can take simple precautions. They should never share PINs, passwords or one-time passwords with callers. They should avoid clicking unfamiliar banking links sent by text or email. Unexpected loan alerts or account messages should be checked directly with the bank. There is no indication that all SBI customers are affected.
For now, the episode remains an allegation, not an established breach. Swift verification and clear communication are now essential to protect customer confidence.
