A threat actor has claimed to have obtained data linked to 3.75 lakh State Bank of India accounts, in a disclosure that has raised fresh concerns over the security of customer information in India's banking system. The claim, first flagged by cybercrime monitoring group Cyberpulse56, has not been independently verified, and there is no public confirmation at this stage that the alleged dataset is genuine, complete or directly sourced from SBI systems.
The allegation matters because banking data, even when incomplete, can be highly valuable to criminals. If the material is authentic, it could be used to mount identity theft, targeted phishing campaigns, account takeover attempts and fraudulent loan applications. Cybersecurity experts routinely warn that attackers do not need a full set of credentials to cause harm; names, contact details, account references and other personal markers can be enough to build convincing social engineering attacks.
Unverified but Serious
Cyberpulse56 said the threat actor described the material as the first disclosure of the dataset, suggesting the alleged leak may be newly surfaced in underground forums or private criminal channels. The group also noted that the authenticity, origin and extent of the exposure are unverified. That distinction is important: in cyber incidents, claims of access are often inflated, recycled from older breaches or stitched together from multiple sources to create the appearance of a major compromise.
Even so, the scale cited in the claim is significant. A dataset tied to 375,000 accounts would place the matter among the more consequential alleged exposures involving a major Indian lender, at least in terms of potential customer impact. For a bank of SBI's size, any suggestion of compromise inevitably draws scrutiny because of its vast retail base and its role in the country's financial infrastructure.
Fraud Risk For Customers
The immediate risk in cases like this is not always direct account draining. More commonly, criminals use leaked data to impersonate banks, payment providers or government-linked services in order to trick customers into revealing one-time passwords, card details or login credentials. A credible-looking message that references real account information can significantly increase the success rate of phishing attempts.
There is also a growing market for synthetic identity fraud and loan-related scams, where stolen personal data is combined with fabricated documents to apply for credit products. If the alleged SBI data includes customer identifiers, contact details or account-linked information, it could be repurposed for such schemes. That is why even partial exposure can have long-tail consequences well beyond the initial leak.
For customers, the practical response is familiar but essential: remain alert to unsolicited calls, emails and messages claiming to be from the bank; avoid sharing OTPs or passwords; and verify any request through official channels. Banks typically advise customers to monitor account activity closely and report suspicious transactions immediately.
SBI Under Scrutiny
The claim comes at a time when financial institutions are under sustained pressure to harden their digital defences as India's banking and payments ecosystem becomes more interconnected. Large banks manage enormous volumes of customer data across mobile apps, internet banking, payment rails and third-party service providers, creating a broad attack surface that can be exploited through technical intrusion, insider abuse or vendor compromise.
SBI has not publicly confirmed the alleged breach in the material available so far. In such situations, banks usually conduct internal checks to determine whether the claim relates to a genuine intrusion, a misconfigured system, an exposed third-party repository or an unrelated compilation of previously leaked data. The outcome of that review, if one is underway, will be critical in determining whether this is a real breach, a partial exposure or a false alarm amplified by criminal actors.
Regulators and cybersecurity teams will also be watching for signs of secondary abuse. In many cases, the most damaging phase begins after the initial leak, when attackers test the data against customer accounts, launch phishing waves or sell the information in fragments on illicit markets. The credibility of the claim will therefore depend not only on the dataset itself, but on whether it can be matched to real SBI customers and used in active fraud attempts.
For now, the allegation remains unverified. But in a sector where trust is foundational, even an unconfirmed breach claim can trigger reputational damage, customer anxiety and a wider reassessment of data security controls. The central question is whether the purported access is real, and if so, how much customer information may already be in circulation.