How does the SBI data breach affect customers?, Pg15

Key Highlights:

• State Bank of India (SBI) reported a suspected exposure of customer data on the dark web after receiving alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In.
• On October 21, SBI informed stock exchanges, as per Securities and Exchange Board of India (SEBI) norms, that 3,897 customer records containing Personally Identifiable Information (PII) were identified on the dark web.
• The motive behind such data leaks is primarily financial, with stolen data often aggregated, repackaged, and sold in bulk.
• The exposed data includes sensitive information like customer names, loan applications, KYC documents, account-opening forms, and addresses.

SBI Data Leak.jpg

Detailed Insights:

• The data leak was claimed by an actor named Siriusim, whose identity and origin are unconfirmed.
• Stolen data, even if not fresh, remains valuable and can be bundled into "dumps" for sale.
• Attackers use stolen PII to create "digital dossiers" for more believable scams and exploit underground demand for deepfake services to bypass KYC verification.
• Customers are advised to assume their data is in circulation, avoid sharing OTP, PIN, or CVV, change net banking and YONO passwords, enable Two-Factor Authentication (2FA), and monitor transaction alerts.
• The Internet Freedom Foundation urged the Reserve Bank of India (RBI) to mandate data breach notifications to customers by all regulated entities.
• They also called for the immediate enforcement of Section 8(6) of the Digital Personal Data Protection Act (DPDP), 2023, and Rule 7 of the DPDP Rules, 2025, which are currently slated for May 13, 2027.
• Previous incidents include an SBI server exposure in 2019 and a Bank of Baroda data leak in July 2026.
• Customers can file complaints with their bank, the National Cybercrime Reporting Portal, or escalate to the RBI Integrated Ombudsman.
• Banks are enhancing security through threat intelligence, continuous monitoring, vendor risk reviews, and staff training to counter evolving threats like AI-enabled malware and supply chain compromises.

Key Concepts Involved:

• Personally Identifiable Information (PII): Any data that can be used to identify a specific individual.
• Dark Web: A part of the internet not indexed by search engines, often used for illicit activities.
• KYC (Know Your Customer): A process by which banks verify the identity of their clients.
• Two-Factor Authentication (2FA): A security process requiring two distinct forms of identification to verify a user's identity.