October 16, 2026 (disclosed): A threat actor operating under the handle Siriusim posted on BreachForums claiming unauthorized access to 375,000 KYC records and 2,722 PDF documents from State Bank of India (SBI) customers. The data allegedly includes customer addresses, personal information, loan applications, and account forms. Sample records posted for verification showed matching phone numbers and WhatsApp profile pictures. SBI has not publicly confirmed or denied the breach as of October 19, 2026. Canonical: sbi-kyc-breach2026. Source: Free Press Journal.
What happened
On October 16, 2026, a threat actor named Siriusim posted on the BreachForums dark web marketplace claiming to have exfiltrated 375,000 KYC (Know Your Customer) records and 2,722 PDF documents from SBI. The actor released sample records (4 customer profiles) for verification purposes. Media outlets including Free Press Journal and VarIndia reported the claim on October 16-17. As of October 19, 2026, State Bank of India has made no public statement confirming or denying the breach.
Technical analysis
The threat actor posted data in CSV and PDF formats on BreachForums, a cybercrime marketplace and discussion forum. Sample verification showed matching customer phone numbers, addresses, and KYC photo uploads on WhatsApp. The actual data breach date is unknown — the disclosure on October 16 does not necessarily indicate when the unauthorized access occurred. No access methodology, attack vector, or persistence details have been disclosed by the threat actor.
Data claimed exposed: Customer names, addresses, phone numbers, KYC identification documents, loan application forms, account information, personal demographic data. NOT exposed (per claims): Full payment card numbers, passwords, Social Security equivalents, complete financial statements.
Verification status: Unconfirmed by SBI. Sample records posted by threat actor were partially validated (phone numbers, photos) by independent researchers, but full dataset authenticity remains unconfirmed. Actual breach scope unknown until SBI investigates.
Impact
Scope: 375,000 customer records claimed exposed. SBI has 500+ million customers across India, so this represents a subset if verified. No ransom demand reported; threat actor motivation unclear.
Risks: Identity theft (full names, addresses, phone numbers in attacker hands), KYC document fraud (stolen identification can be used for account opening elsewhere), account takeover (personal information useful for social engineering), phishing (attackers can impersonate SBI and customers know each other), and loan fraud (access to loan application forms enables fraudulent applications).
Indian financial data is valuable on dark web marketplaces for fraud targeting Indian customers and businesses. KYC documents are particularly valuable because they contain government-issued ID numbers and photos.
What to do
- Watch for phishing from fake SBI messages. SBI may contact you directly; verify by calling official SBI phone numbers from your account statement or visiting an official branch.
- Monitor your SBI account activity regularly. Check for unauthorized transactions, new accounts opened, or changes to beneficiaries/contact information.
- Monitor credit reports. Check CIBIL (India's credit bureau) for fraudulent loans or credit inquiries in your name.
- Be cautious of loan/credit offers. Criminals may open accounts using your stolen KYC. Reject any offers you didn't apply for.
- Do not respond to unsolicited calls claiming to be from SBI or banks. Official banks do not ask for OTP, CVV, or passwords via phone or email.
- Consider placing a fraud alert with CIBIL. This flags your credit file so lenders verify identity before extending credit.
- Notify SBI directly if you believe you are affected. Contact your branch or official customer service to report the breach and request investigation.
Regulatory and company response
As of October 19, 2026, SBI has not made any public statement about this breach claim. The Reserve Bank of India (RBI) may have been notified privately, but no public disclosure has been made by either SBI or RBI. Major Indian news outlets (Free Press Journal, VarIndia, Telangana Tribune) have reported on the threat actor's claim, but SBI's silence suggests either ongoing investigation under confidentiality or pending verification.
Related reading
See KYC data protection and fraud prevention.