New Delhi: A hacker group calling itself “Siriusim” has claimed on a cybercrime forum that it possesses 3.75 lakh records and 2,722 PDF documents allegedly linked to customers of State Bank of India — including KYC records, loan applications, account-opening forms, addresses and personal details. The group described the post as a “first release” and shared sample records to support its claim.
The claim was first flagged by the cybersecurity account CyberPulse56 on X on October 16 and picked up by Indian media over October 19 and 20. It is important to state this clearly: the claim remains independently UNVERIFIED. SBI has issued no confirmation or denial, and no independent authority has so far authenticated the data being offered.
This distinction matters. Claims of large banking data dumps surface regularly on cybercrime forums, and a portion turn out to be recycled data from older breaches, fabricated samples designed to attract buyers, or collections of publicly available information dressed up as fresh compromises. Without independent verification, it would be wrong to treat this as an established breach.
That said, prudence costs nothing. If any customer data were indeed in circulation, the most immediate risk would not be empty accounts — it would be targeted phishing. Fraudsters use leaked personal details to craft convincing calls, SMS messages and emails that appear to come from the bank, often creating urgency around KYC expiry, blocked accounts or refund processing.
Customers should watch for an uptick in suspicious calls and messages referencing personal details, and apply the standard defences: never share OTPs, PINs or internet-banking passwords with anyone; SBI never asks for these. Do not click links in unsolicited messages claiming to be from the bank; use only the official app or website. If something feels off, call the bank’s official customer-care number rather than responding to the message.
It is also worth checking whether your mobile number and email registered with the bank are current, so that any genuine alerts reach you promptly. Enable transaction alerts if they are not already active, and review recent account activity for anything unfamiliar.
Once again, the central fact: this is an alleged breach, claimed by an anonymous group on a cybercrime forum, and it stands unverified. SBI customers should stay alert to phishing attempts, follow basic banking hygiene, and await any official statement from the bank before drawing conclusions.
The episode also highlights a recurring pattern in the cybercrime underground. Threat actors routinely advertise large “first release” data dumps — the phrasing Siriusim used — to build interest and attract buyers before proving the data is genuine. Samples are often cherry-picked, and in several past incidents the advertised volume shrank dramatically once the data was examined. CyberPulse56’s flagging of the post is precisely the kind of early-warning work that gives banks and customers time to prepare, but it is not evidence of the breach itself.
For the banking sector more broadly, unverified claims still carry a cost: they erode customer confidence and can trigger a flood of anxious queries to already-stretched customer-care lines. That makes a clear, timely response from institutions all the more valuable — even a statement saying the claim is being investigated would help. As of now, no such confirmation or denial has come from SBI, and customers should treat the situation as one to watch rather than one to panic over. Stay alert, guard your OTPs and PINs, and let the verification process do its job.
