SBI data breach claims: Hacker allegedly leaked 3.75 million records, 2,722 PDF documents; details remain unverified | Today’s news
A cybersecurity monitoring account flagged claims that a threat identified as Siriusim had leaked customer documents and personal information allegedly linked to the State Bank of India. The authenticity of the claims and the extent of any potential exposure of customer data remain unverified.
CyberPulse56 reported the alleged data breach in a post on social media platform X on October 16, 2026. The claimed dataset contains 375,000 CSV lines and 2,722 PDF documents containing personal customer data, loan applications, supporting documents, account opening applications, addresses and other application-related details.
The threat reportedly described it as the first release of the dataset. However, the claim does not disclose the source of the allegedly leaked information.
If the data file attributed to Sirius is found to be genuine and contain sensitive customer records, the information could potentially be used for impersonation, phishing, identity theft or fraudulent loan attempts.
Cyber attacks target financial institutions
SBI’s alleged data breach claim comes amid reports of a series of cyber attacks targeting India’s financial services sector.
The Economic Times reported on October 15, citing people familiar with the development, that as many as 20 financial institutions were hit by a spate of cyber attacks at the beginning of the month. The funds were allegedly siphoned off using stolen credentials of partner banks.
The incidents highlight the risks posed by compromised credentials and weaknesses in the systems connecting financial institutions, payment providers and digital lending platforms.
CERT-In warns of cyber attacks targeting fintech firms, digital lenders
Independently, The Indian Computer Emergency Response Team (CERT-In) issued an alert on October 9 against multiple cyber attacks targeting non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment service providers and digital wallets.
According to the advisory, attackers compromise Internet applications, exposed application programming interfaces (APIs), and privileged endpoints to steal payment gateway and partner bank credentials.
Using these credentials, threat actors directly invoke funds transfer and payout APIs from a whitelisted organization’s infrastructure, bypassing safeguards such as KYC checks, credit approvals, beneficiary verification, and transaction limits.
Fraudulent transactions allegedly use fake reference identifiers and route funds to attacker-controlled mule accounts across multiple banks.
