SBI Confirms Dark Web Customer Data Leak: Inside the 3.75 Lakh BreachForums Dump, the 5-Day Disclosure Gap, and DPDPA Notification Mandates

1. The Dark Web Dump: What Siriusim Put Up for Sale

On October 16, 2026, the illicit cybercrime community BreachForums saw a post from an actor operating under the alias Siriusim. The actor advertised an exclusive, uncirculated dataset allegedly extracted directly from State Bank of India's infrastructure.

The dump was divided into two distinct payloads:

• 3,75,000 CSV Customer Rows: Structured spreadsheets containing lead generation records, applicant profiles, Customer Information File (CIF) IDs, and branch metadata.
• 2,722 Unencrypted PDF Documents: Complete loan application packets, account-opening dossiers, proof-of-address paperwork, and KYC files.

To demonstrate authenticity, the threat actor leaked four full customer sample profiles. Independent cybersecurity verification by The Free Press Journal confirmed the veracity of the sample: the phone numbers were active and in service, and a leaked passport photograph matched the individual's live WhatsApp profile photo.

2. Chronological Timeline: The 5-Day Anatomy of a Banking Breach

How the breach transitioned from an underground forum post to a parliamentary investigation demand, step by step:

3. What Was Leaked vs. What Was Spared

Understanding the blast radius of this incident requires distinguishing between transactional credentials and personal identity assets:

Even without direct account credentials, this PII payload is dangerous. Fraudsters equipped with a customer's full name, registered mobile, date of birth, CIF ID, and residential address have everything required to execute targeted SIM-swap attacks, bypass basic call-center identity checks, and launch high-conviction spear-phishing campaigns masquerading as SBI loan officers.

4. The 5-Day Silence: The Statutory Dilemma under DPDPA Section 8(6)

The most critical governance failure in the SBI incident was not just the breach itself—it was the disclosure latency.

While SBI fulfilled its SEBI material disclosure obligations on October 21 to pacify stock market volatility, what about the 3,897 citizens whose private identities were sitting on BreachForums?

Under Section 8(6) of India's Digital Personal Data Protection Act (DPDPA), 2023:

"In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal intimation of such breach in such form and manner as may be prescribed."

Under the forthcoming DPDP Rules, 2025 and the existing RBI Advisory No. 3/2026, banks cannot satisfy compliance merely by filing a vague one-page letter to stock exchanges. They are expected to:

1. Directly notify each affected customer without undue delay via registered channels.
2. Specify the exact categories of data that were compromised.
3. Provide immediate guidance on protective actions (e.g. locking SIMs, monitoring credit profiles, resetting passwords).
4. Maintain a public, real-time remediation ledger and grievance resolution path.

5. Historical Echoes: The January 2019 SBI Quick Exposure

This is not State Bank of India's first brush with unsecured data infrastructure.

In January 2019, an unprotected, unencrypted Elasticsearch server hosted at an SBI data centre in Mumbai powering SBI Quick (the bank's missed-call banking service) was discovered accessible on the public internet without a password. The open server leaked tens of millions of text message logs—including customer phone numbers, partial account numbers, real-time balances, and recent transaction records.

Seven years later, the recurring vulnerability points to a structural enterprise flaw: shadow vendors, direct sales partners (DSAs), and decentralized marketing endpoints operating outside the core security boundary.

6. The Road Ahead: Why Enterprise BFSI Must Shift Left

The SBI BreachForums incident proves that the old paradigm of banking security—securing only the Core Banking Solution (CBS) while allowing DSA partners, lead aggregators, and marketing databases to operate unmonitored—is dead under the Digital Personal Data Protection Act.

When the Data Protection Board of India begins enforcement, the maximum statutory penalty of ₹250 Crore per incident under Section 33 will not care whether the breach occurred on a core database or an auxiliary vendor server. The Data Fiduciary bears ultimate legal responsibility.

Indian enterprises must implement automated data discovery, rigorous vendor telemetry tracking, and instantaneous user notification systems before the next dark web post hits the headlines.