SBI says it notified customers after data of nearly 3,900 account holders leaked

The State Bank of India (SBI) on Friday said it had individually notified customers whose personal information was leaked on the dark web following a cyberattack on Wednesday.

About 3.75 lakh customer records were released on the dark web, of which 3,897 contained personally identifiable information, the bank said.

The statement came after digital rights organisation Internet Freedom Foundation flagged that SBI had informed stock exchanges about the data leak but had not notified affected customers.

SBI said customers’ account balances and funds remained safe. “Customers are advised to follow safe digital banking practices, never share their OTP, PIN or password with anyone, and remain vigilant against suspicious calls, messages and emails,” it added.

The bank said it had contacted affected customers individually through email or WhatsApp.

In July, customer data and internal documents from state-run Bank of Baroda were also leaked on the dark web, Reuters reported.

The Reserve Bank of India has repeatedly warned lenders about cybersecurity risks that could affect financial stability.