State Bank of India (SBI) has individually informed customers whose data was identified in a recent breach, assuring them that their account balances and funds remain safe.

"Further to our earlier post regarding the recent cyber incident, the Bank has individually informed all customers whose data was identified as being involved through email and/or WhatsApp. We reiterate that your account balances and funds are safe with us," the bank said in a statement on Friday.

The update came a day after SBI confirmed that a preliminary analysis had identified 3,897 customer records containing personal information among approximately 3.75 lakh records found on the dark web.

SBI Launches Investigation Into Cyber Incident

The bank said it activated its cyber incident response protocols and appointed an independent cybersecurity agency to investigate the incident after receiving alerts from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) on October 16.

According to the preliminary analysis, the identified records reportedly contained customers’ names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch details, customer information file (CIF) identifiers, lead IDs and metadata associated with loan and lead records.

SBI said a detailed investigation was necessary to establish the authenticity and completeness of the exposed data, determine its source and extent, and assess the potential risks to customers and the bank.

Cybersecurity Account Claims 3.75 Lakh Records Leaked

The disclosure followed a claim by cybersecurity monitoring account CyberPulse that a threat actor using the name Siriusim had leaked documents and personal data allegedly linked to SBI.

According to the post, the dataset contained 3.75 lakh rows in CSV files and 2,722 PDF documents. The files allegedly included customer information, loan applications, supporting documents, account-opening forms and addresses.

The bank has engaged a cybersecurity agency empanelled by CERT-In to conduct an independent assessment of the incident.

SBI Says Core Operations Remain Unaffected

SBI said the incident had no material impact on its core business operations, financial performance or business continuity. It added that its core functions continued to operate normally.

The investigation is ongoing, with remedial and preventive measures being implemented.