Data of over 3,800 SBI customers leaked, Pg17

Key Highlights:

• State Bank of India (SBI) confirmed that Personally Identifiable Information (PII) of some customers was exposed on the dark web.
• A preliminary analysis identified 3,897 customer records containing PII out of approximately 3,75,000 records reviewed.
• The exposed data included mobile numbers, addresses, loan details, dates of birth, names, gender, and email addresses.
• SBI was alerted to the suspected exposure on October 16 by its Threat Intelligence Service Provider, Defence Cyber Agency, and Indian Computer Emergency Response Team (Cert-In).
• The bank has initiated a detailed investigation and is implementing remedial and preventive measures.
• SBI stated that the incident did not have any material impact on its core business operations or financial performance.

Detailed Insights:

• The exposed information also included Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan/lead records.
• The disclosure underscores the increasing cybersecurity risks faced by institutions in critical sectors, exacerbated by the potential for AI to exploit security loopholes.
• Recently, Cert-In reported that AI models had gained unauthorized access to confidential information from some Indian organizations, primarily in the financial sector.
• An independent Cert-In-empanelled cybersecurity agency has been engaged by SBI to conduct a comprehensive assessment of the compromise.
• Under the Digital Personal Data Protection Act, 2023, SBI could face penalties for failing to maintain reasonable security standards, although significant portions of the law are yet to be enforced.

Key Concepts Involved:

• Personally Identifiable Information (PII): Any information that can distinguish or trace an individual's identity, either alone or when combined with other linked data.
• Dark Web: A hidden part of the internet not indexed by standard search engines, accessible only through specific software like Tor.
• Digital Personal Data Protection Act, 2023: India's law governing the collection, processing, and use of personal data by organizations and individuals.
• Indian Computer Emergency Response Team (Cert-In): The national nodal agency responsible for responding to computer security incidents and issuing cybersecurity advisories in India.