SBI data breach exposes 3,897 customer records; banks plan faster cyber-incident sharing

What the breach exposed

State Bank of India (SBI), the country's largest lender, received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about suspected exposure of customer data on the dark web. A preliminary analysis of around 375,000 records found online identified 3,897 customer records containing personally identifiable information.

The information included names, registered mobile numbers, dates of birth, email and residential addresses, along with branch and customer identifiers and metadata linked to loan and lead records. SBI activated its cyber incident response and containment protocols and appointed an independent CERT-In-empanelled cybersecurity agency to investigate the nature and extent of the exposure. The bank has said the incident had no material impact on its core business operations, financial performance or business continuity.

Root-cause analysis still under way

SBI chairman C. S. Setty, speaking at the bank's second-quarter results press meet on 3 November, said the root-cause analysis was still being done and would take some time. He said the bank's focus had been on containment measures and on identifying the vulnerabilities that led to the breach and fixing them.

Setty said SBI had undertaken a complete cybersecurity drill, including an API sweep, and that vulnerability assessment is an ongoing process. He added that the bank is turning to artificial intelligence tools to counter AI-enabled threats, saying, in his words, that the industry needs to fight AI with AI tools, and that an industry-level sandbox is being developed to test AI models in a controlled environment before wider deployment.

A faster way for banks to warn each other

Setty, who is also chairman of the Indian Banks' Association (IBA), said the association is seriously working on a structured mechanism for sharing information about cybersecurity incidents among member banks. At present, he said, incidents are definitely shared with regulators and security agencies, but a structured system would let banks inform each other the moment an incident happens so that others can immediately take remedial measures.

The move comes amid a rise in cyber incidents across the banking system. Recent months have also seen cyber-related incidents or concerns at Bank of Baroda, AU Small Finance Bank and Spandana Sphoorty Financial, according to ETBFSI. Setty said digital adoption and security need not be mutually exclusive, but that the industry needs to work collectively to protect trust in the financial system as digitalisation increases the attack surface area.

Editorial disclosure

This article was researched with AI assistance and reviewed by the publisher before publication. Report factual errors through our contact page.