A threat actor who goes by the name Siriusim has claimed to have leaked SBI and its subsidiaries’ customer data. The claim involves approximately 375,000 CSV rows and 2,722 PDF documents, potentially containing personal information, residential addresses, loan applications, account-opening forms, and supporting documents.

The exposure could create significant privacy risks and provide attackers with information that may be used for targeted fraud and identity theft.

Through this blog, we will understand the impact of the claimed data breach on individuals and organizations, and what they can do.

About the claimed data breach: SBI has confirmed

In its corporate filing with the National Stock Exchange of India,  State Bank of India has confirmed that it “experienced an incident involving the loss of certain data”.

The company reported that on October 16, 2026, the company received communications from its  Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of their customer data on dark web.  

A preliminary analysis found that ~375000 records and 3897 customer records containing Personally Identifiable Information (PII) were available on the dark web. The exposed information includes:

• Customers’ registered mobile numbers
• Dates of birth
• Names
• Gender
• Email addresses
• Residential addresses
• Branch
• CIF identifiers
• Lead IDs
• Metadata associated with loan/lead records and other related files

The bank also reported that it promptly activated its cyber incident response and containment protocols and that the data breach does not have any material impact on the bank’s core business operations, financial performance or business continuity.

Impact

If the reported data is genuine, potential consequences include:

• Identity theft: Personal information and supporting documents could be misused to impersonate customers.
• Targeted phishing and social engineering: Attackers could use genuine customer details to make fraudulent communications appear legitimate.
• Financial fraud: Exposed application documents could potentially support fraudulent loan applications or other identity-based financial abuse.
• Privacy violations: Disclosure of residential addresses and personal financial application details could affect customer privacy.
• Regulatory and reputational impact: If unauthorized disclosure is confirmed, the incident could create compliance obligations and affect customer trust.

These are potential risks associated with the alleged exposure, not confirmed outcomes of this incident.

SharkStriker’s recommendations

• Validate the alleged exposure: Identify whether the reported records correspond to organizational data and establish their source, authenticity, and sensitivity.
• Review data access and exfiltration activity: Examine relevant database, application, file-access, identity, and network logs for unusual access or bulk data transfers.
• Strengthen access controls: Apply least-privilege access to customer records, loan applications, and supporting documents; review privileged accounts and third-party access.
• Protect sensitive data: Apply appropriate encryption, data loss prevention controls, and restrictions on bulk downloads or unauthorized transfers.
• Prepare for potential customer-data misuse: If exposure is confirmed, follow the applicable incident response and notification requirements, and assess whether exposed identities or credentials require additional protective action.

SharkStriker’s actions

SharkStriker has reviewed the publicly reported allegations and identified the potential risks associated with the claimed exposure of customer information.

Our recommended focus is on validating the data exposure, reviewing relevant access and exfiltration telemetry, and assessing detection opportunities for suspicious bulk access to sensitive records. The incident should remain classified as an alleged data breach until supported by verified evidence.