A hacker group calling itself Siriusim has allegedly claimed access to 375,000 records and 2,722 PDF documents linked to State Bank of India (SBI), raising fresh concerns about the security of sensitive banking information. The claim was highlighted by cybersecurity monitoring account CyberPulse56 on October 16, 2026, and reported by Moneycontrol on October 20. The alleged dataset reportedly includes customer information, residential addresses, loan applications, account-opening documents and supporting paperwork. However, the authenticity and origin of the material have not been independently verified.
The allegation does not establish that 375,000 individual SBI customers have been affected, nor does it confirm that the bank’s core systems were breached. CyberPulse56 has cautioned that the data’s authenticity and the extent of any potential exposure remain unverified. SBI had not responded to a request for comment by the time of publication, according to the report. If the information is genuine, it could create risks of targeted phishing, identity theft and fraudulent loan applications, making the investigation and verification of the claim important for customers and the banking sector.
Key Takeaways
- Alleged records: A hacker group named Siriusim reportedly claims to possess 375,000 entries and 2,722 PDF documents linked to SBI.
- Potentially sensitive data: The material allegedly includes addresses, customer information, loan applications and account-opening documents.
- No confirmed breach: The authenticity, source and scope of the alleged data exposure remain unverified.
- Customer risk: If genuine, the information could be used for targeted scams, identity theft or fraudulent applications.
- SBI response: The bank had not responded to a request for comment by publication time, according to Moneycontrol.
- Broader concern: The allegation highlights the importance of cybersecurity monitoring, incident reporting and protecting customer information across banking systems.
What Is the Alleged SBI Data Breach?
The claim centres on an unidentified threat actor using the name Siriusim. According to CyberPulse56, the group says it possesses a dataset containing approximately 375,000 entries in CSV format, alongside 2,722 PDF documents associated with SBI.
CSV files are commonly used to organise information in rows and columns, while PDFs can contain forms, scanned documents and supporting records. The reported file formats alone do not establish what information is authentic or whether it came directly from SBI.
The alleged documents reportedly include personal customer information, residential addresses, loan applications, account-opening applications and other supporting paperwork. Such material can be sensitive because it may contain details that criminals could use to make fraudulent messages or impersonation attempts appear legitimate.
CyberPulse56 first flagged the claim on October 16 and cautioned that the data had not been verified. The report published by Moneycontrol on October 20 likewise described the material as an allegation rather than a confirmed breach.
There is an important distinction between a threat actor claiming to possess data and a verified cybersecurity incident. Investigators would need to establish whether the documents are genuine, where they originated, whether they contain current information and whether unauthorised access actually occurred.
Does the claim mean 3.75 lakh SBI customers were affected?
Not necessarily. The figure of 375,000 refers to the number of entries allegedly held by the group, not a verified count of individual customers.
A dataset may contain duplicate entries, outdated records, incomplete information or records associated with multiple applications from the same person. It may also include data linked to third parties or related entities. Without examining and verifying the material, it is not possible to establish how many individuals, if any, have been affected.
Similarly, the existence of 2,722 PDF files does not prove that all the documents are genuine SBI records or that every file contains sensitive customer information.
For these reasons, the claim should not be presented as proof that SBI suffered a confirmed breach affecting 375,000 customers.
What Information Could Be at Risk?
If the alleged dataset is genuine, its potential sensitivity would depend on the precise information contained in each record.
Residential addresses and customer details could help criminals tailor messages to specific individuals. Loan applications and account-opening documents may contain more extensive personal information, depending on the forms and supporting documents involved.
The danger is not limited to the exposure of passwords or banking credentials. Criminals can also use personal details to make fraudulent communications more convincing.
| Alleged information | Potential misuse if genuine |
|---|---|
| Customer details | Personalised impersonation attempts |
| Residential addresses | Targeted scams or identity-related fraud |
| Loan applications | Fraudulent loan-related communications |
| Account-opening documents | Attempts to impersonate applicants or misuse personal information |
| Supporting paperwork | Social engineering and more convincing phishing messages |
These are potential risks based on the types of documents described in the report. They are not confirmation that any of the information has been exposed or misused.
A fraudster who knows a customer’s address or that the person has applied for a loan may be able to construct a message that appears to come from a bank employee. The recipient may be more likely to trust the message because it refers to a real application or personal detail.
This is why data security extends beyond protecting account passwords. Organisations must also protect application records, supporting documents, internal systems and third-party services that may handle customer information.
How a Data Exposure Could Lead to Financial Fraud
One of the main concerns surrounding alleged banking data leaks is the potential for targeted social engineering.
In a generic phishing attempt, a criminal may send a broad message claiming that an account will be blocked unless the recipient takes immediate action. A targeted message can be more persuasive if it refers to a person’s bank, address, loan application or other specific details.
A criminal could, for example, pretend to be a bank representative and claim that a loan application requires additional verification. The message might direct the recipient to a fraudulent website or pressure them into revealing an OTP, PIN, password or other authentication information.
The reported dataset does not prove that such scams have occurred in connection with the SBI allegation. It illustrates why the authenticity and scope of the claim matter: genuine personal records can increase the credibility of later impersonation attempts.
Customers should remember that knowledge of personal details does not prove that a caller or message is legitimate. They should independently contact the bank through its official channels rather than follow links or telephone numbers supplied in suspicious communications.
SBI and India’s Banking Cybersecurity Framework
SBI is India’s largest public-sector bank and operates a substantial network of branches and digital banking services. Protecting customer information across such a large organisation requires multiple layers of security, including access controls, authentication, monitoring, secure document handling and incident response.
SBI’s public digital-banking guidance advises customers not to share sensitive authentication details such as passwords, PINs and one-time passwords. These precautions remain important even when a data-breach claim has not been confirmed.
The Reserve Bank of India has also established cybersecurity requirements for regulated financial institutions. The RBI’s July 2026 directions, as described in recent reporting, require banks to report cyber incidents to the regulator through its DAKSH platform within six hours of detection and to notify CERT-In proactively.
Separately, CERT-In’s 2022 directions require specified cybersecurity incidents to be reported within six hours of detection or notification. These reporting requirements are intended to help authorities respond to incidents and improve the coordination of cybersecurity investigations.
The existence of these rules does not establish that SBI has suffered a breach or that a particular reporting obligation has been triggered in this case. Whether a reportable incident has occurred depends on the facts established by the bank and the relevant authorities.
A Wider Warning for India’s Financial Sector
The allegation comes amid broader cybersecurity concerns affecting financial services in India.
The Economic Times reported on October 15 that cyberattacks had affected around 20 banks, non-banking financial companies and fintech firms, with attackers allegedly exploiting stolen credentials and weaknesses in payment application programming interfaces. CERT-In also issued a warning about threats involving compromised credentials and unauthorised fund transfers.
No confirmed connection has been established between those incidents and the Siriusim claim involving SBI. They should therefore be treated as separate developments.
Nevertheless, the reports illustrate the range of risks facing financial institutions. Cybersecurity incidents can involve stolen credentials, software vulnerabilities, compromised third-party systems or the unauthorised disclosure of documents. Each requires a different investigation and response.
The exposure of documents can be particularly difficult to assess because information may be copied or transferred without immediately disrupting a bank’s customer-facing services. A bank can continue operating while investigators examine whether particular records were accessed or disclosed.
This is why incident verification, access monitoring, supplier oversight and prompt customer communication are important elements of banking security.
What SBI Customers Should Do Now
Because the alleged breach remains unverified, customers should not panic or assume their information has been exposed. However, basic security precautions can reduce the risk of fraud regardless of whether this particular claim proves genuine.
Customers should take the following steps:
- Never share OTPs, PINs or passwords. A caller who knows your name, address or loan details still does not have a legitimate reason to request these credentials.
- Be cautious with loan-related messages. Verify unexpected requests for documents, fees or account confirmation through SBI’s official channels.
- Avoid suspicious links and attachments. Do not use links in unsolicited messages to sign in to internet banking or update personal information.
- Monitor account activity. Review transactions and alerts, and report any unauthorised activity to the bank promptly.
- Contact SBI directly if concerned. Use contact details obtained from the bank’s official website, app or branch rather than those supplied in an unexpected message.
- Report suspected financial cybercrime. In India, suspected cyber financial fraud can be reported through the national cybercrime helpline at 1930 and the official portal at cybercrime.gov.in.
Customers should also be wary of people claiming they can check whether an individual’s records appear in a leaked dataset, particularly if they ask for payment, authentication codes or additional personal information.
The Bigger Picture
The SBI allegation highlights the risks that arise when claims about sensitive financial records circulate before their authenticity is established. The reported figures—375,000 entries and 2,722 PDFs—are significant, but they do not independently prove that SBI’s systems were compromised or establish the number of customers affected. A credible assessment requires verification of the data’s source, contents and scope.
The incident also demonstrates why banking cybersecurity must address more than unauthorised transactions. Personal documents and application records can become tools for impersonation and fraud if exposed. For banks, the priority is to investigate credible claims and communicate verified findings; for customers, it is to maintain strong security habits without treating unconfirmed reports as proof that their accounts are compromised.
Looking Ahead
The next important development will be independent verification of the alleged dataset and clarification from SBI or relevant cybersecurity authorities. Investigators would need to establish whether the documents are authentic, how the group may have obtained them and whether the information relates to SBI customers, subsidiaries or another source. Until those questions are answered, the allegation should remain clearly distinguished from a confirmed data breach.
For customers, the sensible approach is vigilance rather than panic. Avoid sharing authentication credentials, independently verify suspicious communications and report any unauthorised transactions immediately. The broader lesson for financial institutions is that prompt incident assessment, effective monitoring and transparent communication are essential to maintaining confidence in digital banking.
Frequently Asked Questions
1. Has SBI confirmed a data breach?
The reporting available on October 20, 2026, did not independently confirm the alleged breach. A group calling itself Siriusim claims to possess SBI-linked records, but the authenticity and source of the data remain unverified.
2. How many records do hackers claim to have?
The group reportedly claims to possess 375,000 entries and 2,722 PDF documents. These figures have not been independently verified and do not establish the number of individual customers affected.
3. What information is allegedly involved?
The reported material may include customer details, residential addresses, loan applications, account-opening documents and supporting paperwork. The precise contents and authenticity have not been established.
4. Should SBI customers change their passwords immediately?
The allegation alone does not establish that customers’ passwords or banking credentials have been exposed. Customers should use strong, unique passwords, enable available security protections and change credentials promptly if they suspect compromise or receive a verified instruction from the bank.
5. How can customers protect themselves from fraud?
Never share OTPs, PINs or passwords. Avoid suspicious links, independently verify loan-related requests and review account activity. Report suspected cyber financial fraud through India’s 1930 helpline or cybercrime.gov.in.
6. What should happen next?
SBI and relevant cybersecurity authorities would need to verify whether the dataset is genuine, determine its origin and assess whether any customers were affected. Until that verification occurs, the claim should not be treated as a confirmed breach.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
