SBI Data Breach Claim: Hackers Allege Access to 3.75 Lakh User Records

An unverified claim alleges that a threat actor known as Siriusim has posted customer records and banking documents online, purportedly belonging to users of India's State Bank of India (SBI). The alleged dataset is said to contain 375,000 rows in CSV files and 2,722 PDF files, though the exact number of unique individuals affected remains unconfirmed.

CyberPulse first reported on the allegation on October 16, 2026. According to their report, the dataset may include personal customer information, loan applications, supporting documents, account-opening forms, and address details. The threat actor, Siriusim, reportedly posted samples on BreachForums, claiming this as the first disclosure of the dataset.

However, the authenticity, source, and true extent of the alleged data exposure are currently unverified. Reports indicate that SBI had not officially commented on the claims as of October 19, 2026, and the possibility that the data is recycled from previous leaks cannot be ruled out.

Crucially, the available reports do not provide any evidence of how the alleged records were obtained. There is no indication that the data originated directly from SBI, its subsidiaries, or any third-party service providers handling banking applications. Investigations would be required to validate the samples, identify their owner, and cross-reference the claimed records with system logs to determine the source and scale of any potential breach.

If the alleged data leak is confirmed to be genuine, the compromised information could be exploited for various malicious purposes, including identity theft, loan fraud, and targeted phishing attacks. Threat actors could leverage the detailed application and personal information to craft highly convincing fake bank communications, aiming to trick individuals into revealing further sensitive data.

This incident highlights the persistent threat of data breaches targeting financial institutions and their customers. While the current claim remains unverified, it serves as a reminder for customers to remain vigilant against potential scams and to always verify unexpected communications from their bank through official channels. Customers should also be wary of suspicious APK files and never disclose sensitive credentials like passwords or one-time passwords.

For SBI, a thorough investigation is necessary to either confirm or refute the allegations. Preserving relevant logs and preparing to notify affected customers, should the breach be confirmed, would be critical steps in managing the incident and mitigating further damage. Until concrete evidence emerges, this remains an alleged data leak rather than a confirmed compromise of SBI user accounts.