An unverified SBI data breach claim alleges that a threat actor named Siriusim posted customer records and banking documents online. The claimed dataset contains 375,000 CSV rows and 2,722 PDF files, but those figures do not establish that 3.75 lakh unique customers were affected.

CyberPulse reported the allegation on October 16, 2026. Its post described personal customer information, loan applications, supporting documents, account-opening forms and address details. The actor called it the first disclosure of the dataset. The authenticity, source and extent of the alleged exposure remain unverified.

SBI Data Breach Claim

According to India Today, Siriusim posted the claim on BreachForums and shared what it described as four sample customer records. The report said the material may include Know Your Customer (KYC) records, Aadhaar numbers and residential addresses. These details remain allegations rather than confirmed findings from an investigation.

CSV files store information in rows and columns, while PDFs can hold forms and scanned documents. A row count alone cannot show how many people appear in a dataset. Multiple applications or duplicate entries could relate to the same person, and document totals do not prove separate victims.

India Today reported on October 19 that SBI had not addressed the claims when its article was published. The outlet said it had requested comment and could not independently confirm the breach. It also remained unclear whether the material was newly exposed or recycled from earlier leaks.

The available reports do not establish how the alleged records were obtained. Their source could not be traced to SBI itself, a subsidiary or a service provider handling banking applications. There is no verified evidence in these reports identifying an exploited flaw, stolen login or compromised server.

That uncertainty matters because documents bearing a bank’s name do not, by themselves, establish access to its core banking systems. Any investigation would need to validate samples, identify their owner, and check the claimed records against system logs before drawing conclusions about the source or scale.

If genuine, the records could support identity theft, loan fraud and targeted phishing. Criminals could use application details to make fake bank calls or messages sound convincing. Cybersecurity News has previously covered fake SBI reward apps and fraudulent YONO deactivation alerts, both relevant examples of banking impersonation, not evidence connecting those campaigns to this claim.

Customers should verify unexpected bank messages through official channels, avoid shared APK files, and never disclose passwords, PINs, or one-time passwords. SBI should assess the claim, preserve logs, and notify affected customers if an investigation confirms exposure. Until then, this remains an alleged data leak, not a confirmed compromise of accounts.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post SBI Data Breach Claim – Hackers Allegedly Claim Access to 3.75 Lakh Users’ Database appeared first on Cyber Security News.