In brief
- A hacker group claims access to 375,000 SBI loan files and 2,722 PDFs, alleging a data breach at the State Bank of India. This claim sparked concern among market participants and depositors.
- Threat actors claim to hold over 375,000 rows of customer data in CSV format plus 2,722 PDF files, including Personal Identifiable Information and Aadhaar numbers and PAN details.
- Experts say there is currently no evidence that SBI core transactional banking systems or customer deposits have been directly breached, despite the alleged leak of onboarding documents.
- Regulatory scrutiny is heightened under the RBI, CERT-In, and Digital Personal Data Protection Act as the incident prompts examination of data handling and regulatory compliance by Indian financial institutions.
On 19 and 20 October 2026, alarm bells rang across India’s financial and cybersecurity sectors following reports that the country's largest public-sector lender, the State Bank of India (SBI), had suffered a significant data breach.
An anonymous threat actor group operating under the handle "Siriusim" surfaced on dark web forums and underground channels, claiming to possess a database containing confidential records linked to approximately 3.75 lakh customers (375,000 customers) alongside 2,722 PDF documents.
The claim—first highlighted by cybersecurity intelligence feed CyberPulse56 and subsequently reported by ET Now and Trak.in—sparked immediate concern among market participants and retail depositors. With a balance sheet representing nearly a quarter of India’s banking system and over 50 crore (500 million) account holders, any compromise of SBI’s data infrastructure carries national economic implications.
However, a technical examination of the dataset, previous banking incident histories, and cybersecurity protocols reveals a critical distinction: while the leak of sensitive onboarding documents is a serious privacy failure, there is currently no evidence that SBI’s core transactional banking systems have been breached or that customer deposits are directly compromised.
What Was Allegedly Leaked?
According to threat intelligence analysts tracking the disclosure, the threat actor claims to hold a structured package consisting of over 375,000 rows of customer data in CSV format, accompanied by 2,722 individual PDF files.
The data fields allegedly exposed include:
Personal Identifiable Information (PII): Full customer names, dates of birth, residential addresses, and contact phone numbers.
National Identification Identifiers: Masked or unmasked Aadhaar numbers and Permanent Account Number (PAN) details.
Loan Application Files: Scanned account-opening application forms, loan assessment sheets, income documentation, and branch-level processing records.
To substantiate their claims, the threat actors published sample excerpts. While cybersecurity researchers confirm that the samples resemble genuine Indian banking onboarding paperwork, the origin, age, and complete scope of the dataset have not been independently validated by Indian forensic auditors.
Ingress Analysis: Core Banking System vs. Third-Party Ecosystem
In the immediate aftermath of such disclosures, public anxiety typically focuses on whether "the bank was hacked." To evaluate the actual threat, one must understand how large public sector banks structure their digital operations.
State Bank of India’s core financial ledger—its Core Banking Solution (CBS), powered by enterprise-grade infrastructure—is heavily compartmentalised. Transactional systems that handle account balances, deposit transfers, and payment authentication (such as UPI PINs, net-banking passwords, and ATM debit card PINs) do not store static PDF scans of customer electricity bills or loan application forms.
The presence of 2,722 PDF documents strongly indicates that if a breach occurred, the compromise took place within an ancillary document repository. In India's retail lending ecosystem, these repositories are frequently managed by external entities:
Third-Party Direct Selling Agents (DSAs): External agency networks that collect retail loan applications, scan applicant documents, and upload them to intermediary portals.
Business Correspondents (BCs): Rural and semi-urban banking agents who capture customer KYC paperwork on local devices.
Misconfigured Cloud Storage: Storage buckets (such as Amazon S3 or Microsoft Azure Blob) operated by third-party software integrators without adequate public-access restrictions.
This distinction does not minimise the breach, but it clarifies the risk: hackers cannot siphon money directly out of an account using this leaked data alone.
The Real Danger: Hyper-Targeted Social Engineering
While deposits remain secure inside the core banking ledger, the exposure of 3.75 lakh KYC records and loan applications creates severe secondary fraud vectors.
Armed with authentic loan documentation, cybercriminals move away from generic, clumsy spam messages to craft hyper-personalized social engineering campaigns:
When a caller quotes your exact home address, your applied loan amount, and your branch name, conventional fraud warning signs disappear. The victim naturally presumes the caller is an authorised SBI credit officer.
Regulatory Ramifications: DPDP Act and CERT-In
The incident arrives at a juncture of heightened regulatory scrutiny for Indian financial institutions. Under the regulatory framework established by the Reserve Bank of India (RBI), the Indian Computer Emergency Response Team (CERT-In), and the Digital Personal Data Protection (DPDP) Act, 2023, banks face stringent statutory compliance duties:
Six-Hour Incident Reporting: Under CERT-In directions, all systemic cybersecurity incidents, unauthorised data access, and leaks must be formally notified to the national agency within six hours of detection.
DPDP Act Penalties: As a Data Fiduciary, a financial institution is legally mandated to employ reasonable security safeguards to prevent personal data breaches. Under Section 33 of the DPDP Act, failure to take adequate measures to prevent data breaches carries statutory financial penalties of up to ₹250 crore ($30 million) per violation.
Vendor Due Diligence: RBI master directions on outsourcing explicitly state that banks cannot abdicate data protection responsibilities to third-party vendors. Even if the leak originated from an external software vendor or DSA agency, the regulatory accountability rests with the regulated entity.
As digital banking integration expands, the boundary of financial security is no longer confined to the bank vault. For depositors, awareness of social engineering tactics remains the ultimate firewall against digital exploitation.
