Cyberattack hits India’s largest bank, exposes customer records

The State Bank of India (SBI), India's largest lender by assets, is investigating a suspected cyberattack that exposed thousands of customer records containing personal information on the dark web. The bank identified nearly 4,000 records as part of an initial assessment, with about 375,000 records analyzed in total. The leak highlights cybersecurity risks facing India's banking sector as lenders expand digital services and handle more sensitive customer data.

In July, the state-run Bank of Baroda also reported a similar breach. Data leaks have caused regulatory scrutiny, reputational damage, and eroded customer trust for financial institutions worldwide, including Asia. Vivek Iyer, a Grant Thornton Bharat partner, stated that the cyber threat landscape is continually changing due to rapid technological transformations in the financial services sector.

Financial institutions must strengthen their cyber posture and security operation centers, he added. The Reserve Bank of India has warned lenders about potential cyber risks that could harm financial stability. According to a central bank survey of 43 Indian banks and shadow lenders, nearly one-third reported a moderate or significant increase in cyber risks compared to a year ago.

SBI, a systemically important bank in India, disclosed that the leaked records included customers' names, mobile numbers, dates of birth, email addresses, residential addresses, branch and customer identification numbers, and details associated with loan and lead records. The bank assured that the incident had no material impact on its core business operations, financial performance, or business continuity.