SBI hack claim: group says it holds 3.75 lakh customer records

A hacker group calling itself Siriusim has claimed on the BreachForums cyber-crime forum that it holds customer data linked to State Bank of India (SBI), including about 3.75 lakh rows of records and 2,722 documents. The claim was first flagged by a cyber-security watcher on X on 16 October 2026 and drew wide attention by 19 and 20 October. The authenticity, origin and size of the data have not been independently confirmed, and no official statement from SBI addressing the claim had been reported by 20 October.

SBI is India's largest public-sector bank, and KYC files are among the most sensitive personal records a bank holds. A KYC record is the identity file a bank collects when an account is opened, usually with proof of identity, address and a photograph. If such files were genuine and in criminals' hands, they could be used for targeted fraud: callers posing as bank staff who already know a victim's address, date of birth and nominee are far more convincing than a random scam call.

At the same time, a forum post is not proof of a breach. Criminal groups often exaggerate the size of what they hold, repackage data leaked years earlier, or describe data from a third-party vendor as if it came from a big brand, because a famous name attracts buyers and attention. That is why the row count, the claim that the data came from SBI, and the inclusion of Aadhaar numbers should all be treated as allegations until the bank or an investigating agency says otherwise.

The episode is a test for India's newer data-protection framework, the Digital Personal Data Protection Act, which places duties on organisations that hold personal data. For the technology industry, including the start-ups and software vendors that handle loan applications, onboarding and KYC checks for banks, it is a reminder that a leak anywhere in that chain can end up attached to the bank's name.

Short-term: SBI customers may receive more scam calls, SMS messages and emails from people using the news as cover. The safest response is to refuse to share OTPs, PINs, passwords or card details with anyone who calls or messages, even if they know personal details, and to contact the bank only through its official app, website or branch.

Long-term: If the data is confirmed as genuine, questions will follow about where it leaked from, whether customers were informed, and what the bank and any vendor must do under data-protection rules. If it proves to be old or recycled data, the episode will still add pressure on banks to audit how KYC documents are stored and shared with outside firms.

Who is affected: Potentially SBI customers whose details appear in the alleged dataset, the bank and any service providers that handle its customer documents, and fintech and software firms that process KYC data for lenders.

Questions and Answers