A threat actor known as Siriusim says it has leaked KYC documents, loan files and addresses tied to 375,000 State Bank of India customer records. SBI has not confirmed the breach happened.
A post surfaced on the cybercrime forum BreachForums on October 16, claiming access to 375,000 rows of customer data and 2,722 PDF documents belonging to State Bank of India, the country’s largest lender by assets and customer base. According to BusinessToday, the leaked files allegedly include loan applications, account-opening forms, Know Your Customer records and residential addresses, the kind of paperwork a bank collects when it opens an account or processes credit. SBI has not issued a statement confirming or denying the claim as of this writing.
The post was first flagged publicly by the X account CyberPulse56 and then picked up by outlets including CyberPress and cybersecuritynews.com, both of which reported the same figures: 375,000 CSV rows and 2,722 supporting PDF documents. Those numbers describe rows in a file, not necessarily 375,000 distinct people. Duplicate entries, test records and multiple documents per customer could all inflate the count, and nobody outside Siriusim has confirmed how the data was obtained or whether it came from SBI’s own systems at all.
That is the uncomfortable middle ground this story sits in right now. The data looks real. The source does not check out yet.
The Free Press Journal, an Indian outlet, ran its own check on the publicly posted sample and found that phone numbers listed in the records were active lines, and that WhatsApp profile photos tied to those numbers matched the faces in the attached KYC documents. That is a meaningful signal. It means at least some of the people named in the sample are real, reachable individuals, not a fabricated dataset stitched together for shock value. It does not mean the full 375,000-row claim is genuine, and it does not establish that SBI’s infrastructure was the point of entry. KYC packets, loan files and address data pass through branches, third-party verification vendors, credit bureaus and loan processing partners before they ever touch a bank’s core systems, and any one of those could be the actual leak point.
SBI is not a small target to get wrong. The bank serves more than 50 crore, over 500 million, customers, according to figures cited around its Yono 2.0 digital banking rollout. Its mobile and internet banking app, Yono, already has roughly 9.6 crore, about 96 million, active users and handles more than 27 million logins a day at peak, with the bank aiming to double that user base to 20 crore within two to three years. A breach touching even a sliver of that base, if confirmed, would be one of the largest financial data exposures India has seen this year.
A pattern, not an isolated incident
This is not the first Indian state-run bank to face this exact situation in 2026. Bank of Baroda, another major public-sector lender, confirmed in July that an employee’s email account had been compromised, after a hacker claimed to have leaked roughly 1TB of data including customer names, Aadhaar numbers, corporate banking records and loan files, according to Business Today and The Record. Bank of Baroda said its core banking systems were not touched and that it detected and contained the intrusion. The entry point there was not a database wall falling down. It was one compromised inbox.
That is worth sitting with. India’s banking system has leaned hard into digital rails, UPI processes billions of transactions a month and apps like Yono are built to onboard hundreds of millions of people, but the actual points of failure keep showing up in the unglamorous places: a vendor’s database, an employee’s email, a server someone forgot to password-protect. SBI itself has a history here. In 2019, an unprotected SBI server in a Mumbai data center was found exposing financial data on millions of customers, with no password required to access it, a lapse first reported by TechCrunch at the time.
None of that proves Siriusim’s claim is true. It does mean the burden on SBI to investigate quickly and say something concrete is higher than it would be for a smaller, less exposed institution. Until the bank confirms or denies where this data came from, customers whose phone numbers and faces already check out in the leaked sample are the ones left waiting.
Also read: AWS Turned Its 18-Tab Pricing Spreadsheet Into an AI Chatbot • Krea 3 Ultra edits images faster and cheaper than GPT Image 2.5 • IonQ, Rigetti and D-Wave Crater as IBM Promises Quantum Advantage Is Near
The Metropolix, from Startup Fortune
→
This article is posted in Technology News, check it out for more related stories.
Almost there. Sign in and your reply posts straight away.
Click Here For The Original Source.
——————————————————–
