Data breach: SBI admits exposure of its customer data on the Dark Web

The Hindu | Lalatendu Mishra

State Bank of India disclosed a dark web data breach on 21 October 2026 after receiving warnings from CERT-In and the Defence Cyber Agency. Preliminary analysis of 3,75,000 leaked records revealed that 3,897 customer profiles containing personally identifiable information were compromised, including mobile numbers, residential addresses, dates of birth, and loan metadata.

Threat group Siriusim allegedly released the records alongside 2,722 PDF documents containing account applications. This breach exposes affected account holders to targeted financial impersonation scams. SBI insisted core operations remain uncompromised. The Internet Freedom Foundation criticized the five-day delay between threat notifications and regulatory disclosures to stock exchanges. Financial institutions face structural reporting gaps. Under current CERT-In 2022 guidelines and Reserve Bank of India frameworks, entities must notify regulators rather than affected individuals. Statutory provisions under Section 8(6) of the Digital Personal Data Protection Act 2023 requiring direct customer notification do not take effect until 13 May 2027.

Comment

The detection of exfiltrated data by the Defence Cyber Agency rather than internal security operations centers reveals persistent visibility gaps in critical national infrastructure. Third-party notification dependencies leave financial institutions reactive to threat actors such as Siriusim during initial exposure windows. Operational delay in mitigating unverified dark web listings increases customer exposure to targeted financial phishing.

A parallel breach involving eMudhra web security keys demonstrates how credential leaks in vendor ecosystems compound threat vectors for state-backed financial entities. Attack vectors leveraging secondary software providers frequently bypass primary network firewalls undetected. Unmitigated cryptographic compromises at eMudhra erode the overall security posture across CERT-In monitored networks.

Strategic Question for Discussion

When critical financial infrastructure relies on external threat intelligence from the Defence Cyber Agency rather than internal detection, which systemic vulnerabilities emerge in incident containment timelines?

The available evidence points toward severe operational latency when financial institutions depend on external agencies for breach notification. This structural disconnect delays payload verification while threat actors exploit exfiltrated credentials in secondary phishing campaigns. My assessment is that external alerts indicate perimeter telemetry tools remain blind to quiet exfiltrations via third-party vendor pipelines.

Share your assessment in the comments below.

Read the original article