In a Regulation 30 disclosure dated Oct 21, State Bank of India says it "experienced an incident involving the loss of certain data". On Oct 16 it received alerts from its threat intelligence provider, India's Defence Cyber Agency and CERT-In about suspected exposure of customer data on the dark web. In a preliminary analysis of about 375,000 records, SBI identified 3,897 customer records with personal data: registered mobile numbers, dates of birth, names, gender, email and residential addresses, branch and CIF identifiers, lead IDs, and metadata from loan/lead records and related files.

SBI says it activated incident response and containment, engaged an independent CERT-In-empanelled firm to establish the source and extent, and that there is no material impact on core operations, finances or continuity. The source of the leak (for example a lead-management or partner system) has not been disclosed.

Why it matters: lead and loan metadata plus verified mobile numbers is ideal fuel for loan-offer and KYC-update phishing. If you serve Indian banking customers, expect SBI-themed smishing and vishing; SBI customers should treat unsolicited loan or KYC calls as suspect.