The SBI data breach at the State Bank of India’s Global IT Centre in CBD-Belapur, Navi Mumbai, involved the theft of approximately 3.75 lakh bank records, application data and files containing customer information, according to a complaint registered with the CBD-Belapur police. The incident came to light about a month after hackers accessed the bank’s centralised computer server, with an FIR registered on November 12.
The breach reportedly took place between October 10 and 15 at the SBI Global IT Centre. Bank officials later learnt that some of the stolen information had been published on the dark web. The complaint was filed by SBI official Bhavesh Nikam, 38, and names unknown persons allegedly operating through the hacker group ‘Siriusim’ and an Internet Protocol address.
According to the police complaint, the attackers accessed and removed around 32 CSV files containing about 3.75 lakh records from SBI applications. They also took JSON files and 2,721 PDF files containing Personally Identifiable Information. The material included customer details, loan application records, account-opening applications, contact information and addresses.
The incident places a Navi Mumbai-based banking technology facility at the centre of a case involving the security of large-scale financial and identity data. The files reportedly contained information used in routine banking and lending processes, including applications and customer correspondence. The source report did not specify how many individual customers were represented across all the stolen files.
Arun Pawar, senior inspector at the CBD-Belapur police station, said bank authorities had claimed that the stolen data was removed from the dark web and had not been misused. The report did not provide details of how the removal was carried out or how the bank assessed whether the information had been accessed, copied or circulated elsewhere.
Cybersecurity and privacy lawyer Prashant Mali said customers should remain alert to phishing and other cyberattacks. He also said the bank’s claim that the data had been removed and not misused could indicate that the hackers may have exchanged it for a ransom or sold it to another buyer, although the police report did not establish that either possibility had occurred.
The police have invoked provisions of the Bharatiya Nyaya Sanhita relating to simple theft and criminal conspiracy, along with relevant sections of the Information Technology Act. The accused remain unidentified in the FIR, and the investigation is being conducted by the CBD-Belapur police.
SBI authorities told police that the data had been removed from the dark web and had not been misused. The next steps are the police investigation into the server access, the identification of the accused and further assessment of the data affected.
