An anonymous hacker group calling itself Siriusim claims it is holding confidential data linked to 3.75 lakh State Bank of India customers, along with 2,722 PDF documents. The claim, which first surfaced on a cybercrime forum last week, picked up fresh steam today as major news outlets reported it, with the country’s largest bank yet to respond publicly.
Cybersecurity account CyberPulse56 flagged the listing on X on October 16, and reports published today, October 20, say the alleged dataset includes personal customer information, loan applications, account-opening forms, addresses and other application-related documents. The authenticity of the claim, however, remains unverified.
What exactly do the hackers claim?
According to the reports, the threat actor using the alias Siriusim posted a listing on BreachForums, a cybercrime forum known for trading stolen data. The listing claims 375,000 customer records in CSV format and 2,722 PDF documents allegedly linked to SBI and possibly its subsidiaries.
The alleged data reportedly includes:
- Loan applications and supporting documents
- Know Your Customer (KYC) records, including CKYC numbers
- Video KYC (VKYC) verification fields
- Names, dates of birth, mobile numbers and residential addresses
- IFSC details and employment and income declaration forms with salary details
CyberPulse56 said the threat actor described the release as the “first disclosure” of the dataset, meaning more could follow.
What investigators found in the samples
The Free Press Journal examined four sample records the hacker made freely accessible to demonstrate authenticity. Its investigation found the phone numbers listed in the samples were valid. In one striking check, the WhatsApp profile picture linked to a listed number matched the passport-size photograph attached to the same person’s KYC document, also made publicly accessible by the threat actor.
The findings suggest that at least some of the personal information in the samples may belong to real individuals. However, the report stressed that this does not independently establish that the entire 375,000-row dataset is genuine, nor does it confirm how the information was obtained, whether directly from SBI, a subsidiary, or a third-party service provider handling banking applications.
What has SBI said?
So far, nothing. The Economic Times reported that State Bank of India had not responded to its emails till press time, and The Free Press Journal said the bank had not answered its phone and email inquiries either. There is no confirmation yet on whether SBI’s own systems were compromised or whether the alleged data originated elsewhere.
ET Now reported that SBI shares are expected to remain in focus on October 21 following the claims, as investors weigh the reputational and financial implications.
Why this matters for SBI customers
If even part of the claim proves true, the exposed data is exactly the kind criminals use. The cybersecurity accounts reporting the story warn that the information could enable identity theft, financial fraud, targeted phishing campaigns and fraudulent loan applications taken out in victims’ names.
The concern is especially sharp because the data allegedly includes full KYC packs: names, addresses, phone numbers and identity documents. That combination is enough to make phishing calls and messages look convincingly real.
How to protect yourself right now
- Do not act on urgent calls or messages: SBI never asks for OTPs, PINs or passwords over phone, SMS or WhatsApp. Hang up and call the bank’s official helpline yourself.
- Watch for phishing: Be extra suspicious of messages about loans, KYC updates or account blocks in the coming days. Verify through the official YONO app or website.
- Monitor your accounts: Turn on SMS and email alerts for every transaction and scan statements for activity you do not recognise.
- Lock your cards: Use the YONO app to switch cards on or off and set transaction limits.
- Report fast: If you spot anything odd, report it to your branch and to the national cyber helpline 1930 without delay.
Frequently asked questions
Has SBI confirmed the data breach?
No. As of today, the bank has not responded to media queries, and the claim’s authenticity, origin and extent remain unverified.
What data do the hackers claim to have?
Around 3.75 lakh customer records and 2,722 PDF documents, reportedly including loan applications, KYC records, CKYC numbers, phone numbers, addresses and salary declaration forms.
Should SBI customers worry?
It is sensible to stay alert. The samples examined so far suggest some real personal data is involved, but the full dataset is unverified. Following basic precautions costs nothing.
What should I do if I get a suspicious call claiming to be from SBI?
Do not share any OTP, PIN or password. End the call and reach out to SBI through official channels yourself.
Where can I report suspected fraud?
Call the national cybercrime helpline 1930 or visit your nearest SBI branch immediately.
We will update this story as SBI responds and more details are verified.
