SBI Data Breach Allegedly Exposes Personal Information of 3.75 Lakh Users

A threat actor known as Siriusim allegedly leaked customer information and documents related to the State Bank of India (SBI), according to a CyberPulse post dated October 16, 2026.

The claim involves 375,000 CSV rows and 2,722 PDF documents; however, the authenticity, origin, and extent of this dataset remain unverified.

The reported figure should not be interpreted as confirmation that 375,000 individual customers were affected.

The count of CSV rows does not provide a reliable measure of the number of unique individuals represented, and the source offers no independently validated customer count.

SBI Data Breach

According to CyberPulse, Siriusim asserts that the material includes personal customer information, loan applications, supporting documents, account-opening applications, addresses, and other related details. The actor claims that this release represents the dataset’s first disclosure.

These descriptions suggest exposure of application records rather than a confirmed breach of transaction-processing systems. However, the available report does not clarify which systems housed the material, how it was obtained, or whether it originated directly from SBI’s infrastructure.

The post also lacks a confirmed timeline of the alleged intrusion, details about the exploited vulnerability, identification of any malware, or technical indicators linking the claim to a specific attack method. Therefore, attributing the alleged disclosure to ransomware, credential theft, or an exposed database would be premature.

If the claims are authentic, the combination of personal information and banking application documents could facilitate identity theft, targeted phishing, financial fraud, and fraudulent loan applications. CyberPulse identifies these as potential risks, not confirmed outcomes.

Distinguishing an allegation from a verified breach is crucial here. A threat actor’s description alone cannot confirm that every listed document is genuine, up to date, or linked to distinct customers. Additionally, the reported volume does not provide evidence that account balances, passwords, or payment credentials were exposed.

The referenced post does not mention these categories. Thus, labeling them as compromised would exceed the evidence at hand. Similarly, there’s no indication that attackers accessed customer accounts or initiated unauthorized transactions.

CyberPulse has urged SBI to investigate the claim, determine whether customer records were indeed exposed, and notify potentially affected individuals through official channels. These recommendations do not imply that SBI has completed any investigation or issued breach notifications.

For a definitive assessment, investigators would need to establish the records’ provenance, validate their link to SBI, and determine the number of unique customers rather than duplicate or repeated entries.

They would also need to assess whether the PDF documents overlap with the CSV records before calculating any affected population. Until they answer these questions, the incident remains an alleged data disclosure involving 375,000 claimed rows, not a verified breach affecting 375,000 SBI customers.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.