Threat Actor Claims Leak of State Bank of India Customer Data

A threat actor operating under the name Siriusim alleged on October 16, 2026, that they had obtained and posted customer records belonging to the State Bank of India. The claim was reported by CyberPulse and later covered by India Today, though the authenticity of the data remains unverified.

The actor asserted that the leaked material contained 375,000 rows in CSV format alongside 2,722 PDF documents. These files reportedly include personal customer information, loan applications, account-opening forms, and residential addresses. The threat actor described this release as the first disclosure of the dataset.

View the original post on X

Context and Background

Cyber Security News noted that the row count does not confirm that 375,000 unique individuals were affected. CSV files store data in rows and columns, meaning multiple entries could relate to a single person. The total number of documents also fails to prove the number of distinct victims involved.

India Today reported on October 19, 2026, that the State Bank of India had not provided a comment on the allegations. The outlet stated it had requested clarification but could not independently verify the breach. It remained unclear whether the material represented a new exposure or recycled data from earlier incidents.

Who Is Affected

The available reports do not establish how the records were obtained. There is no verified evidence linking the data to a specific exploited flaw, stolen login credentials, or compromised server within SBI’s infrastructure. The source could not be traced to the bank itself, a subsidiary, or a service provider handling banking applications.

GBHackers highlighted that the lack of technical indicators makes it premature to attribute the disclosure to ransomware, credential theft, or an exposed database. The reports do not confirm whether account balances, passwords, or payment credentials were included in the alleged leak.

What should you do?

If the claims are authentic, the combination of personal information and banking application documents could facilitate identity theft, targeted phishing, financial fraud, and fraudulent loan applications. CyberPulse identified these as potential risks, not confirmed outcomes. Criminals might use application details to make fake bank communications appear convincing.

That suggests organizations should monitor for synthetic identity fraud attempts. Any investigation would need to validate samples, identify their owner, and check claimed records against system logs before drawing conclusions about the source or scale of the breach.

What to do and how to stay safe: State Bank of India

• Monitor financial statements and credit reports for unauthorized activity or new accounts opened in your name.
• Verify the authenticity of any unsolicited communications claiming to be from your bank, especially if they reference specific application details.
• Review personal data exposure alerts from credit bureaus to identify if your information appears in known data dumps.
• Once the vendor provides an update on the scope, check official advisories for specific remediation steps or affected service tiers.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many customers were confirmed affected by the SBI breach?

No customers have been confirmed affected; the claim involves 375,000 CSV rows, but this does not equate to unique individuals.

Did SBI confirm the data breach?

No; India Today reported on October 19, 2026, that SBI had not addressed the claims and no comment was received.

What types of data were allegedly leaked?

The alleged dataset includes personal information, loan applications, supporting documents, account-opening forms, and addresses.