Yesterday we wrote about what Indian rules require a bank to do after a leak like this. The other half of the story is the data itself, and on that the honest position is narrower than either the headlines or the bank suggest.

What the filing establishes

State Bank of India told the exchanges on 21 October that a preliminary analysis of around 375,000 records circulating on the dark web identified 3,897 containing personally identifiable information: mobile numbers, dates of birth, names, gender, email and residential addresses, branch and CIF identifiers, lead IDs, and metadata attached to loan and lead records.

That 375,000 figure answers a question we had to leave open yesterday, when accounts differed on whether the filing named a total. It does, as the size of the set examined rather than as a count of victims.

What it does not establish, in its own words

The filing describes the exposure as suspected, and says a detailed investigation is needed "to determine the potential source and extent of the exposure". That is the bank saying, in a regulatory document filed on 21 October about alerts it received on 16 October, that it still did not know where the data came from.

Not whether it was taken from SBI, a subsidiary, a vendor, or an agent working on its behalf. Asked directly by Indian reporters which of those it was, SBI has not answered.

The question matters because of what is in the set. Loan applications and account-opening documents are not core banking records. In Indian retail banking they pass through originators, direct selling agents and document-processing vendors, any of whom may hold a copy. A dataset shaped like this one is as consistent with a third party as with the bank, and nobody has shown which.

Who is selling it

The listing is attributed to an actor calling itself Siriusim, on BreachForums. It has no known prior history. A monitoring account flagged the claim on 16 October, the same day the alerts reached the bank.

Siriusim claims more than 3.75 lakh rows in CSV and 2,722 PDF files, described as personal details, residential addresses, loan applications and account-opening documents, and it published four sample records.

The bank's filing does not mention the PDFs, does not name Siriusim, and does not attribute the exposure to anyone.

Four records were checked

An independent look at the published samples found the phone numbers in them to be valid, and that has been reported as verification of the leak. It is worth stating precisely: 4 records had working phone numbers. That is evidence the sample is not invented. It says nothing about the rest of the set, nothing about how current the records are, and nothing about where any of them came from.

The same gap runs in the other direction. The bank examined 375,000 records and found personal information in 3,897. It has not said what the remaining records contain.

The Aadhaar discrepancy

The sample records are reported to include Aadhaar numbers. The bank's confirmed field list does not, and the filing says it has not established whether identity documents are in the set at all. Both statements can be true at once, and if they are, the thing that should worry a customer sits outside the 3,897.

We are not in a position to resolve that, and neither, on its own account, is the bank.

What to do

  • If you bank with SBI, assume a caller may know your name, date of birth, branch and address, and treat that knowledge as worth nothing as proof of identity.
  • Do not read out a one-time passcode to anybody who already sounds like they have your file. That combination is exactly what this set enables.
  • If you applied for a loan through an agent or an aggregator rather than at a branch, your paperwork took a longer route than your account did. That is where a copy is most likely to sit, whoever turns out to be at fault here.
  • Watch for a second disclosure. If the source turns out to be a vendor, the affected population is not defined by who banks with SBI.

What is not established

  • Where the data came from. The filing says the source is still to be determined.
  • Whether SBI's own systems were involved at all.
  • Whether the full 375,000 records are authentic. Four samples were checked by outsiders and the bank describes its own review as preliminary.
  • What the records outside the 3,897 contain.
  • Whether the 2,722 PDF documents exist.
  • Whether Aadhaar or PAN numbers are in the set, which the filing explicitly leaves open.
  • Who Siriusim is, or whether the actor took the data or bought it.