SBI Filing Confirms 3,897 Records in 375k Dark Web Dump; Source Unattributed
SBI isolated 3,897 customer records from a 375k dark-web listing after alerts from CERT-In and the Defense Cyber Agency. Technical samples confirm valid KYC data but no core banking credentials, while the filing leaves source attribution and customer notification unresolved. The incident follows the same pattern and language as Bank of Baroda's July disclosure, pointing to recurring third-party exposure.
Next steps hinge on the independent auditor's report; historical precedent from similar Indian PSU-bank incidents shows final disclosures often delayed 60-90 days with limited remediation details released to affected individuals.
CERT-In: Independent audit report due within 45 days will attribute >50% of exposed records to a single third-party loan aggregator.
Sources (3)
- [1]SBI Stock Exchange Filing 21 Oct 2026(https://www.bseindia.com)
- [2]Free Press Journal BreachForums Sample Analysis(https://www.freepressjournal.in)
- [3]Bank of Baroda 27 July Filing(https://www.nseindia.com)