Alleged State Bank of India Data Leak Exposes Loan Files and Personal Records
An online group claims to have published thousands of banking documents, but the bank has not confirmed if the files are genuine or how they were obtained.
Key points
- Threat actor Siriusim posted 375,000 CSV rows and 2,722 PDFs on BreachForums on October 16, 2026.
- The files reportedly contain loan applications, KYC records, Aadhaar numbers and residential addresses.
- State Bank of India has not verified the breach or explained how the data was accessed.
A threat actor operating under the name Siriusim alleges that it has leaked personal records belonging to State Bank of India customers. According to CyberPulse, the group posted these files on the BreachForums platform on October 16, 2026. The actor claims the dataset includes sensitive banking documents and personal information, though the authenticity of these files remains unverified.
The claimed dataset consists of 375,000 rows in CSV format and 2,722 PDF files. CyberPulse reported that the material includes loan applications, supporting documents, account-opening forms and address details. India Today noted that the actor shared four sample records, which may include Know Your Customer data and Aadhaar numbers. These reports describe the contents as allegations rather than confirmed facts.
View the original post on X
Context on the data source
The number of rows in the CSV files does not prove that 375,000 unique customers were affected. A single customer could have multiple entries or applications within the same dataset. The PDF count similarly does not establish the number of distinct victims. Documents bearing a bank’s name do not automatically confirm that attackers accessed core banking systems or transaction-processing servers.
Who is affected
India Today reported on October 19 that State Bank of India had not addressed the claims at the time of publication. The bank did not confirm whether the material was newly exposed or recycled from earlier leaks. It remains unclear if the data originated from SBI’s own infrastructure, a subsidiary or a third-party service provider handling banking applications.
Our take on the response
No technical indicators, such as malware signatures or exploited vulnerability details, have been linked to this alleged disclosure. Attributing the leak to ransomware or credential theft is premature given the lack of evidence. If the records are genuine, they could facilitate identity theft, financial fraud and targeted phishing campaigns using application details to mimic legitimate bank communications.
For customers and users
Monitor your credit reports and bank statements for unfamiliar activity. Be wary of unexpected calls or messages from entities claiming to represent your bank, especially if they request personal details or payment. Use strong, unique passwords for financial accounts and enable multi-factor authentication where available. If you receive suspicious communications, contact your bank directly through official channels to verify any claims.
Background: Ransomware
Stop ransomware by enforcing least privilege, maintaining offline backups, and disabling macro execution. These three measures remove the attacker’s ability to encrypt your data or spread across your network. Software updates help, but they do not replace strict access controls and immutable storage.
Read the full guide: How to Stop Ransomware: 3 Layers That Actually Work
What to do and how to stay safe: State Bank of India
- Review your recent account statements and credit reports for unauthorized transactions or new inquiries.
- Contact your bank using official phone numbers or website links to verify if any suspicious activity has occurred on your accounts.
- Check your email and messaging apps for phishing attempts that reference recent banking applications or personal data.
- Update your passwords for financial services and ensure multi-factor authentication is enabled on all critical accounts.
Step-by-step guide: 7 Credential Leak Mistakes That Expose Your Accounts
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many customers were confirmed to be affected by this leak?
No customers have been confirmed affected; the claim of 375,000 rows does not equate to that many unique individuals.
Did State Bank of India confirm this breach?
No, the bank has not addressed the claims or verified the authenticity of the leaked data as of October 19, 2026.
What specific data is alleged to be in the leak?
The files reportedly contain loan applications, KYC records, Aadhaar numbers, addresses and account-opening forms.
