Mumbai: State Bank of India (SBI) is facing scrutiny following claims by an alleged hacker group that it has obtained sensitive information linked to approximately 3.75 lakh customer accounts, including documents containing personal details and Know Your Customer (KYC) records.

The alleged group, identified as Siriusim, reportedly claimed access to customer-related data and thousands of documents. However, the authenticity of the material, its origin and the extent of any possible exposure remain unverified.

SBI had been contacted for a response, but a confirmation from the bank was not available in the report. The claim should therefore not be treated as an established breach of the bank’s systems.

The development has raised concerns about the potential exposure of banking documents and the risks that could arise if the information is genuine.

Hacker group claims access to 3.75 lakh customer records

According to reports, Siriusim claimed to possess data associated with around 3.75 lakh SBI customer accounts. The alleged dataset reportedly includes approximately 3.75 lakh rows of data and 2,722 PDF files.

The documents are said to contain personal information and banking-related records, including loan applications, account-opening forms, customer addresses and supporting documents.

Such records can contain information used by banks to establish a customer’s identity, assess applications and maintain regulatory documentation.

However, the reported figures are based on claims attributed to the alleged hacker group and cybersecurity-related online reporting. They do not establish that 3.75 lakh genuine SBI customer records have been compromised.

The origin of the material is also unclear. It has not been independently established whether the alleged files came directly from SBI, a third-party service provider or another source. It is also unknown whether the information is recent or includes data that may have circulated previously.

Why the alleged KYC exposure matters

KYC documents are used by financial institutions to verify the identities and addresses of customers. Depending on the documents submitted, they may contain names, residential addresses, identity details and other personal information.

If authentic KYC or account-opening documents were exposed, they could potentially be misused for identity-related fraud, targeted phishing attempts or impersonation.

Loan applications and supporting records could also provide criminals with information that makes fraudulent messages appear credible. For example, a scammer who knows a customer’s name, address or details about a financial application may attempt to impersonate a bank employee.

These are potential risks associated with the type of information reportedly involved. There is currently no verified evidence in the cited reporting that the alleged data has been used to defraud SBI customers.

The distinction is important: the presence of a claim online does not establish that the data is genuine, that it was obtained through an intrusion into SBI’s systems or that any particular customer has been affected.

SBI response and investigation remain important

The reported claim has not been independently verified, and the available reporting does not establish the technical circumstances behind the alleged exposure.

Confirmation from SBI or a credible independent cybersecurity investigation would be needed to determine whether the records are genuine, where they originated and whether any customer information was accessed without authorisation.

A proper investigation would also need to establish the nature of the information involved, the number of affected individuals, the period during which any unauthorised access may have occurred and whether protective measures are required.

Until such findings become available, it would be premature to describe the incident as a confirmed breach of SBI’s core banking systems.

The matter nevertheless highlights the importance of protecting financial records across banks, technology platforms and third-party service providers. Customer information can pass through multiple systems during account opening, loan processing and identity verification, making security controls and access monitoring essential.

What SBI customers should do

Customers do not need to assume that their accounts have been compromised because of the unverified claim. However, maintaining basic cyber-safety precautions is advisable.

Customers should be cautious if they receive unexpected calls, text messages, emails or WhatsApp messages that refer to their bank accounts, KYC status or loan applications.

They should follow these precautions:

  • Do not share OTPs or PINs: Never disclose one-time passwords, UPI PINs, passwords or card security details to callers claiming to represent the bank.
  • Verify KYC requests independently: Use SBI’s official website, mobile banking application or a verified branch contact to check whether an update is required.
  • Avoid suspicious links: Do not open unexpected links or download attachments claiming to contain bank statements, KYC forms or account-security alerts.
  • Monitor account activity: Check transactions and report any unfamiliar activity through the bank’s official channels.
  • Report suspected fraud promptly: If money is lost through cyberfraud in India, contact the national cybercrime helpline at 1930 and submit a complaint through the official cybercrime reporting portal.

Customers should not provide additional personal or financial information merely because a caller appears to know details about them. Information obtained from a leaked document, if genuine, could be used to make a fraudulent request sound convincing.

Data security remains a concern for the banking sector

The allegations involving SBI underline the importance of cybersecurity in India’s expanding digital banking ecosystem.

Banks handle large volumes of financial and identity-related information, making the protection of customer records a continuing priority. Security measures must cover not only banking applications and internal systems but also document repositories, access credentials and third-party platforms.

At the same time, claims of data exposure need to be assessed carefully. Unverified online posts can create anxiety among customers, while inaccurate conclusions about the source or scale of an incident can complicate efforts to establish the facts.

The key questions in the SBI case remain whether the alleged records are authentic, how they may have been obtained and whether any customers face a confirmed risk.

For now, the reported exposure remains an allegation rather than a verified breach. Customers should stay alert to suspicious communications while awaiting reliable information from the bank or relevant cybersecurity authorities.