The State Bank of India (SBI) on Wednesday said it had identified 3,897 customer records containing personally identifiable information (PII) in data allegedly leaked on the dark web and had launched a detailed investigation into the incident.In a regulatory filing, the country’s largest lender said it received alerts on October 16 from its threat intelligence service provider Defence Cyber Agency and CERT-In regarding a potential data exposure. A preliminary review of about 3.75 lakh records available on the dark web found 3,897 records containing PII.“The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and metadata associated with loan/lead records and other related files,” the SBI said.The bank said it had activated its cyber incident response and containment measures and engaged a CERT-In-approved independent cybersecurity firm to assess the reported breach and potential risks to customers and the lender.The SBI maintained that the incident had no material impact on its core business operations, financial performance or operational continuity, adding that all critical banking services continued to function normally.The ongoing investigation will examine the authenticity and completeness of the data, determine the possible source and extent of the breach, and assess the risks arising from the incident. The SBI said corrective and preventive measures were being implemented wherever required.The disclosure follows claims by a hacker group identified as “Siriusim”, which allegedly gained access to sensitive data linked to SBI, including customer information, loan applications and account-opening documents.The claim was flagged by cybersecurity monitoring account CyberPulse56 in a post on X. According to the account, the group was allegedly in possession of about 3.8 lakh data records in CSV format and 2,722 PDF documents linked to the lender.The purported dataset reportedly contained customers’ personal details, residential addresses, loan applications, supporting documents and other application-related records. CyberPulse56 first highlighted the claim on October 16, saying “Siriusim” had presented the material as its primary release of the dataset. However, the authenticity and source of the alleged data leak remain unverified.“We propose that this has no significant effect on the bank’s core business activities, financial results or operational continuity. The bank’s primary operations remain active and are functioning smoothly without interruptions. A thorough assessment is underway, and necessary corrective and preventive actions are being taken as required,” the bank said.