State Bank of India, the country's largest lender, is investigating a possible exposure of customer data after alerts on 16 October. A preliminary review of about 375,000 records circulating on the dark web found that 3,897 contained personal data such as names, mobile numbers, dates of birth, addresses and loan details. The bank activated its incident response plan and hired an independent cybersecurity firm to confirm the source and extent. SBI says its operations and customer balances were not affected.

What it means: Even when no money is lost, a leak of identity and loan details is valuable to fraudsters. With a name, phone number, date of birth and details of a loan, a call or message pretending to be the bank becomes far more convincing. That is why banks treat such incidents as serious regardless of whether balances were touched. The fact that the data included metadata from loan records suggests the source may be a partner or an application management system rather than the bank's core, something the investigation will show. For Greek banks and fintechs, the case is a reminder that risk often sits with outside partners such as sales agents, call centres and application platforms. The DORA regulation now requires firms to register and oversee these third parties and to report serious incidents quickly. For customers, the simple rule remains: no bank asks for passwords or one-time codes over the phone, and any suspicious contact should be checked by calling the official number.

Read the original on The Hindu BusinessLine

Related service: myDATA integrations

Related stories