SBI Denies Claim of Breach Exposing 375,000 User Records

Key Takeaways

• An unverified claim surfaced regarding a potential data breach affecting the State Bank of India (SBI).
• A threat actor named Siriusim alleged exposure of 375,000 customer records and 2,722 PDF documents.
• SBI has not confirmed the breach, and the authenticity, source, and scope of the alleged data remain unverified.
• The claimed data, if genuine, could facilitate identity theft and phishing attacks.

Unverified SBI Data Breach Claim Surfaces, Bank Denies Exposure

An unsubstantiated claim of a data breach at the State Bank of India (SBI) has emerged, with a threat actor identifying as Siriusim purporting to have posted customer records and banking documents online. The alleged dataset reportedly comprises 375,000 rows in CSV format and 2,722 PDF files. However, these figures alone do not confirm that 3.75 lakh (375,000) distinct customers were affected.

CyberPulse reported the allegation on October 16, 2026. The social media post detailed the alleged exposure of personal customer information, loan applications, supporting documentation, account-opening forms, and address details. The threat actor characterized this as the initial disclosure of the dataset. As of now, the authenticity, origin, and full extent of this purported exposure remain unconfirmed.

Details of the Alleged Exposure

According to a report by India Today, Siriusim posted the breach claim on BreachForums and provided what were described as four sample customer records. The report suggested that the material might include Know Your Customer (KYC) records, Aadhaar numbers, and residential addresses. It is crucial to reiterate that these details constitute allegations and have not been corroborated by any official investigation.

CSV files organize data into rows and columns, while PDFs are commonly used for forms and scanned documents. A simple count of rows in a CSV file does not definitively indicate the number of unique individuals within a dataset. Multiple applications or redundant entries could pertain to the same person, and the total number of documents does not necessarily equate to an equivalent number of distinct victims.

India Today noted in its October 19 report that SBI had not responded to the claims at the time of publication. The news outlet stated it had sought comment from the bank and was unable to independently verify the breach. It also remains unclear whether the material is newly compromised or if it represents data recirculated from previous breaches or leaks.

Uncertainty Surrounding Source and Validity

The available reports do not specify how these alleged records were obtained. The source of the data has not been definitively linked to SBI directly, one of its subsidiaries, or a third-party service provider involved in handling banking applications. There is no verified evidence within these reports that identifies an exploited vulnerability, stolen credentials, or a compromised server.

This lack of clarity is significant because documents bearing a bank’s name do not, by themselves, confirm unauthorized access to its core banking systems. Any thorough investigation would necessitate validating sample data, identifying the legitimate owner of the information, and cross-referencing the claimed records against system logs before any conclusions can be drawn about the source or scale of any potential compromise.

If the alleged records are found to be genuine, they could be leveraged for various malicious activities, including identity theft, loan fraud, and highly targeted phishing campaigns. Criminals could exploit application details to make fake bank calls or messages appear more credible. Previous cybersecurity incidents have highlighted the risks of banking impersonation, such as fraudulent SBI reward applications and fake YONO deactivation alerts. However, these past campaigns are examples of common threats and are not connected as evidence to the current unverified claim.

What You Should Do

• Verify Communications: Always independently verify any unexpected bank messages or calls through official channels (e.g., calling the bank’s official customer service number) rather than relying on provided contact details.
• Avoid Unknown Files: Do not download or install application files (APKs) from untrusted sources. Only use official app stores for banking applications.
• Protect Credentials: Never disclose your passwords, PINs, or one-time passwords (OTPs) to anyone, regardless of who they claim to be.
• Monitor Accounts: Regularly review your bank statements and transaction history for any suspicious activity.
• SBI’s Actions: SBI should conduct a thorough assessment of the claim, preserve all relevant system logs, and, if an investigation confirms any exposure, promptly notify affected customers as per regulatory guidelines.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.