What We Know About the State Bank of India Data Leak and Its Two Different Counts

State Bank of India, the country's largest lender, said on Oct. 21 that a cyberattack led to 3,897 customer records appearing on the dark web, according to a report carried by KSL News. A separate account says a hacker is claiming a far larger haul, 375,000 rows of customer data, and the two figures have not been reconciled.

Here is what is known, what is claimed and what remains open.

What did State Bank of India say happened?

The bank reported a cyberattack that resulted in 3,897 customer records containing personally identifiable information being disclosed on the dark web, according to the KSL report. A preliminary analysis found that the exposed data included names, mobile numbers, dates of birth, email addresses and residential addresses. It also included brand and customer identifiers and loan records.

The lender said it has hired an independent cybersecurity agency to assess the incident and determine the nature and extent of the leak. It also said it does not expect a material impact on its core business operations, financial performance or business continuity.

What is the hacker claiming?

Startup Fortune reported that a threat actor known as Siriusim posted on the cybercrime forum BreachForums on Oct. 16, claiming to hold 375,000 rows of customer data and 2,722 PDF documents tied to the bank. According to BusinessToday, as cited by Startup Fortune, the files allegedly include loan applications, account-opening forms, Know Your Customer records and residential addresses.

Startup Fortune noted that the number describes rows in a file, not necessarily 375,000 different people. Duplicates, test entries or several documents per customer could raise the count. No one outside the poster has confirmed how the data was obtained or whether it came from the bank's own systems.

Why do the two numbers differ?

That is not settled. The bank's figure of 3,897 records is far smaller than the claimed 375,000 rows. It remains unclear whether both describe the same data, or whether the bank's count reflects only the records it has so far identified in a preliminary analysis. Startup Fortune, in an article published after the bank's statement was reported, said the bank had not confirmed or denied the hacker's claim at the time of writing.

Is any of the leaked data real?

Startup Fortune said the Free Press Journal, an Indian outlet, checked a publicly posted sample. It reported that phone numbers in the records were active and that WhatsApp profile photos linked to those numbers matched the faces in attached identity documents. That suggests at least some of the people in the sample are real.

It does not show that the full 375,000-row claim is genuine. It also does not show that the bank's own systems were the point of entry. Startup Fortune pointed out that identity and loan paperwork often passes through branches, verification vendors, credit bureaus and loan-processing partners, any of which could be the source of a leak.

What does this mean for customers?

For people whose records were exposed, the data types are the kind that identify a person and show where and how to reach them: names, phone numbers, birth dates, email and home addresses, and loan details. Startup Fortune said customers whose details appear in the sample are currently waiting for the bank to say more.

The scale of the bank's customer base is part of why the case is drawing attention. Startup Fortune cited figures from the rollout of its Yono 2.0 digital platform putting the bank's customers at more than 500 million. A confirmed breach touching even a small share of them would be significant, the outlet said. The bank has said the incident will not hurt its operations or finances.

The report also noted that India's banking regulator has pushed lenders in recent years to strengthen their cybersecurity frameworks as threats against financial institutions have grown.

What happens next?

The independent cybersecurity agency's assessment is under way, according to the bank. The findings, including how many people were affected and how the data got out, have not been disclosed.

Sources: KSL News, Startup Fortune