Mumbai: State Bank of India has disclosed a data loss incident after an alert that customer information was suspected to be exposed on the dark web, saying a preliminary analysis identified 3,897 customer records containing personally identifiable information among roughly 3.75 lakh records.
In a filing under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, the bank said it received communications on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In about the suspected exposure.
The exposed data reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan and lead records.
The bank described the finding as preliminary. It did not say that accounts or funds were affected. The disclosure comes amid a run of data-exposure alerts in India in recent weeks.
Cyber-security experts have repeatedly warned that exposed personal data fuels phishing and fraud. CERT-In, the national computer emergency response team, is among the agencies the bank said flagged the alert.
SBI is India's largest lender. Its shares traded within the broader market's weak trend on Wednesday, when the Sensex closed 143 points lower.
The bank did not specify how the data might have been accessed, and said it was examining the matter. For listed companies, such disclosures are mandatory under SEBI norms.
The bank is India's largest lender, and such incidents are a growing worry for institutions that hold large volumes of customer data.