Last few days, the SBI data breach is being reported in the Internet. An October 20 disclosure from a hacker group “Siriusim” made it known to the world that it was in posession of some personal data belonging to SBI. (Moneycontrol.com). The CERT In has issued a notice to SBI for more information and may undertake its own investigation.
As per the report, 3.75 lakh records are reportedly compromised of whcih 3897 may relate to personal information of customers. (See NDTV report)
Similar to the Bank of Baroda case, the incident was reported by a security analyst. A threat actor by name Siriuism claimed the leak involving 375000 CSV rows, 2722 PDF documents, Personal Customer information, Loan applications and supporting documents, account opening applications and other application related details.
The available information does not establish that every affected customer’s account credentials, passwords, PINs or transaction details have been compromised. Nor does the identification of 3,897 customer records establish that 3,897 bank accounts have been accessed or that money has been stolen.
Bank has indicated that the investigation is not complete and hence we are not aware of the root cause. According to some, “Investigators will need to establish whether the data originated from SBI’s systems, a third-party service provider or another source before drawing conclusions,”.
SBI has said the incident has not materially affected its core business operations, financial performance or business continuity. Its investigation is continuing, and the bank has said it will take appropriate remedial and preventive measures in line with applicable regulatory requirements.
What was strange in this instance is that the political parties like Congress have jumped in to pass comments as this report indicates ..where else but in Indian Express.
Reacting to the development, Congress’ media and publicity department head Pawan Khera said, “It is bad enough that the State Bank of India @TheOfficialSBI, the country’s largest public sector bank, has suffered a data breach involving 3.75 lakh rows of data, with 3,897 records containing personally identifiable customer information — including mobile numbers, dates of birth, names, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and loan-related details.”
“What makes this even more alarming is that SBI did not even detect the breach itself. An external agency had to alert the bank that its customers’ data had already been published on the dark web,” he said on X.
Now adding insult to injury, the SBI is yet to inform the very customers whose personal information it has failed to protect, he said.
“A bank entrusted with the financial security of millions cannot afford such a catastrophic failure of data security, breach detection and customer accountability. SBI owes its customers answers. Those responsible must be held accountable,” Khera asserted.
What makes this comment concerning is that politicians are wading in to start criticising Banks for security failures as if it is a political failure of the Government.
This attention of politicians increases the stakes in such data breaches for those entities which have a close association with the Government since whatever commercial failures are observed will be politicised and one day may become the reason for a street protest by people who only want to use every incident as a “Regime Change” demand.
Also refer here…
The Hindu report also indicates that the Internet Freedom Foundation has also raised its objections. It has indicated that a data breachnotice has to be given to the affected individuals. This is part of the DPDPA which is becoming effective on 13th May 2027 which the Internet Freedom Foundation has challenged as unconstitutional and should be scrapped.
Economic Times also provides its report in which it highlights what the customers need to do now. (This is a requirement of data breach notification under DPDPA).
Banks are now under the radar. Sooner they fortify their systems and become DPDPA Compiant, better it is for the country. Otherwise there is a danger of Cockroaches infecting the scene.
In 2022, RBI had announced a Portal called “Daksh” to report such incidents. Hopefully RBI and CERT In will take care of supervising this incident since DPB is still not active and also not in place. We request politicians to stay off and allow professionals to handle the situation.
In the meantime, on OCtober 20/21, a databreach in E Mudhra was reported which was serious but not related to persoanl information. It is related to the integrity of the https transactions of websites. It may however have an indirect impact leading to compromise of information on transit to websites.
Naavi
