PSU bank's customer data on dark web | The Free Press Journal

A threat actor using the name “Siri­usim” has claimed to have hacked 3.75 lakh cus­tomer records and 2,722 PDF doc­u­ments allegedly linked to the State Bank of India (SBI) and poten­tially its sub­si­di­ar­ies on Breach­for­ums, a cyber­crime forum known for trad­ing stolen data. The alleged hack primar­ily involves loan applic­a­tions, sup­port­ing doc­u­ments, KYC records and per­sonal inform­a­tion sub­mit­ted by cus­tom­ers.

The claim was high­lighted by cyber­se­cur­ity account Cyber­pulse56 on X on Octo­ber 16. The threat actor pub­lished four sample cus­tomer records on Breach­for­ums, mak­ing them freely access­ible to demon­strate the alleged authen­ti­city

The threat actor claimed to have hacked 3.75 lakh cus­tomer records and 2,722 PDF doc­u­ments

One of the doc­u­ments appears to be an income declar­a­tion form con­tain­ing info applic­ant’s employer, work details, salary

An invest­ig­a­tion by The Free Press Journal into the pub­licly avail­able samples found that the phone num­bers men­tioned in the records were valid. Fur­ther checks revealed that the What­s­app pro­file pic­ture asso­ci­ated with one of the num­bers matched the pass­port-size pho­to­graph attached to the same indi­vidual’s KYC doc­u­ment, which the threat actor had also made pub­licly access­ible on the forum.

The find­ings sug­gest some sample per­sonal inform­a­tion may belong to real indi­vidu­als, but do not inde­pend­ently estab­lish the authen­ti­city of the entire data set or reveal how it was obtained.

Accord­ing to the Breach­for­ums list­ing, the alleged data set con­tains 375,000 rows in comma-sep­ar­ated val­ues (CSV) format and 2,722 PDF doc­u­ments.

The four sample records examined by FPJ con­tain names, dates of birth, mobile num­bers, email addresses, res­id­en­tial details, occu­pa­tions, nom­in­ees and bank branch inform­a­tion. They also include fields relat­ing to Cent­ral KYC num­bers, video KYC veri­fic­a­tion, IFSC details and bank­ing ser­vices.

The alleged hack primar­ily involves loan-related inform­a­tion, with some records con­tain­ing sav­ings account applic­a­tions and cus­tomer onboard­ing details. It remains unclear whether the data belongs to SBI, its sub­si­di­ar­ies or third-party bank­ing ser­vice pro­viders.

The Free Press Journal con­tac­ted SBI by phone and email, seek­ing its response to the alleged data hack. However, the bank had not respon­ded at the time of going to the press.