Congress pulls up SBI over data breach, seeks accountability; experts call leak 'no ordinary incident'

NEW DELHI: The Congress on Wednesday pulled up the State Bank of India (SBI) over the suspected exposure of 3,897 customer records on the dark web, demanding answers from the country's largest bank and accountability for those responsible. Cybersecurity law expert Pawan Duggal called the incident "no ordinary incident", warning that the exposure could have implications for India's national security.

The criticism came after SBI said a preliminary analysis of around 3.75 lakh records available on the dark web had identified 3,897 customer records containing personally identifiable information. The bank said it was investigating the suspected exposure after receiving alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In).

Congress's media and publicity department head, Pawan Khera, questioned the bank's ability to detect the breach and its response towards affected customers."It is bad enough that the State Bank of India @The Official SBI, the country's largest public sector bank, has suffered a data breach involving 3.75 lakh rows of data, with 3,897 records containing personally identifiable customer information -- including mobile numbers, dates of birth, names, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and loan-related details.""What makes this even more alarming is that SBI did not even detect the breach itself. An external agency had to alert the bank that its customers' data had already been published on the dark web," he said on X.

Khera alleged that the bank had yet to inform customers whose personal information was exposed." A bank entrusted with the financial security of millions cannot afford such a catastrophic failure of data security, breach detection and customer accountability. SBI owes its customers answers.

Those responsible must be held accountable," he asserted.'No ordinary incident': Expert flags security risks Pawan Duggal, chairman of the International Commission on Cyber Security Law, said the suspected leak was particularly serious given SBI's size and the volume of sensitive information it holds."The SBI data leak is no ordinary incident. India is the world’s most populous nation.

The SBI is the country’s largest bank, holding a volume of accounts unmatched by any other financial institution. A leak here involves far more than just names; it includes numerous government accounts, such as those of public sector employees, meaning a vast amount of sensitive government information is exposed.

The intent behind such a leak is clear: state and non-state actors could exploit this data to negatively impact India’s sovereignty, integrity, and security... Section 79 of the IT Act mandates that intermediaries must exercise "due diligence" in the discharge of their functions.

The central government has established specific rules, such as the IT Rules, 2021, and the IT Directions, 2022, that define what constitutes due diligence; it remains to be seen whether these requirements were met... It is high time for India to wake up; the country still lacks a dedicated national law on cybersecurity, and the existing Information Technology Act of 2000 does not adequately address these critical aspects..."The suspected exposure reportedly includes customers' registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses.

The records also contain branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and other related files. SBI says customer balances are safe Responding to the incident, SBI said the suspected exposure had affected a very small number of customers and had not materially affected its core business operations, financial performance or business continuity."Customer balances are completely safe, and we are taking all possible steps to protect the interest of our valued customers," the bank said in a post on X.

SBI said it had activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to investigate the alleged compromise. The bank said a detailed investigation was needed to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the risks to customers and the bank."We reiterate that safety of our customers' financial assets, data and their trust in us remain our highest priorities," it said, adding that remedial and preventive measures were being implemented.

SBI incident amid wider cyber threats The suspected data exposure comes days after CERT-In issued a 'critical' advisory warning that autonomous artificial intelligence agents had accessed live systems and confidential data belonging to Indian organisations without authorisation. In its advisory, titled 'AI Agents as Attack Vectors', the agency said some AI models and agents undergoing research and evaluation had exceeded the authorised scope of their tasks and accessed live systems.

The agents reportedly used credentials and connection settings exposed in application configurations, public code repositories and overly permissive cloud service roles. CERT-In also reported a compromise involving private keys linked to eight intermediate certification authority certificates belonging to India-based certification authority e Mudhra Ltd.

The affected certificates included six Transport Layer Security certificates and two code-signing certificates. The agency warned that the compromised keys could be used to issue fraudulent certificates, impersonate legitimate websites and potentially intercept or modify encrypted communications.

Key quotes

• “no ordinary incident”

• “What makes this even more alarming is that SBI did not even detect the breach itself. An external agency had to alert the bank that its customers' data had already been published on the dark web,”

• “A bank entrusted with the financial security of millions cannot afford such a catastrophic failure of data security, breach detection and customer accountability. SBI owes its customers answers. Those responsible must be held accountable,”

• “Customer balances are completely safe, and we are taking all possible steps to protect the interest of our valued customers,”

• “We reiterate that safety of our customers' financial assets, data and their trust in us remain our highest priorities,”