​FIR Lodged in Navi Mumbai Over Theft of 3.75 Lakh SBI Records and Customer Files - The 420.in

The intrusion took place between October 10 and October 15, during which hackers extracted bank application data, 4,280 customer records, and multiple confidential files. Following a formal complaint lodged by the bank on November 12, the CBD-Belapur police initiated an investigation into the incident.

Data Compromised

According to police officials, unidentified cybercriminals used a hacker group named 'Siriasim' to gain unauthorised access to the SBI Global IT Centre server. The perpetrators stole approximately 32 CSV files linked to various bank applications, containing nearly 3.75 lakh records. In addition, JSON format files and 2,721 PDF files containing personally identifiable information were compromised, with portions of the stolen data later surfacing on the dark web.

The breached files contained personal details of SBI customers, loan application records, new account opening forms, contact numbers, and residential addresses. Investigators noted that such personally identifiable information could be exploited by cybercriminals for financial fraud and phishing attacks.

Bank Response

Bank officials informed the police that SBI's internal team launched an immediate probe after the stolen data appeared on the dark web. The bank has maintained that the leaked material was subsequently removed from the dark web and that its internal inquiry found no evidence of data misuse.

Customer Warning

Experts have advised bank customers to exercise caution against suspicious phone calls, emails, and text messages in the coming days. Fraudsters could use the leaked personal details to impersonate bank officials and target account holders.

By referencing specific account details, KYC updates, loan applications, or transactions, criminals may attempt to deceive customers into sharing one-time passwords, account passwords, and other confidential credentials.

Police Investigation

The CBD-Belapur police have registered the case under relevant sections of the Bharatiya Nyaya Sanhita pertaining to theft and criminal conspiracy, alongside provisions of the Information Technology Act. The FIR names unidentified persons who allegedly accessed the server through the 'Siriasim' hacker group and a specific IP address.

Investigating agencies are currently examining the relevant IP address, server logs, digital footprints, and the files published on the dark web to trace the source of the attack and identify the culprits. The incident has raised broader questions regarding customer data protection and cyber resilience within the banking sector.