Follow us on Google News
Navi Mumbai police have registered a First Information Report nearly a month after cybercriminals breached a centralised computer server at the State Bank of India’s Global IT Centre in Navi Mumbai, stealing around 3.75 lakh bank records and sensitive customer data. The intrusion took place between October 10 and October 15, during which hackers extracted bank application data, 4,280 customer records, and multiple confidential files. Following a formal complaint lodged by the bank on November 12, the CBD-Belapur police initiated an investigation into the incident.
Nature of Compromised Data and Dark Web Leak
According to police officials, unidentified cybercriminals used a hacker group named ‘Siriasim’ to gain unauthorised access to the SBI Global IT Centre server. The perpetrators stole approximately 32 CSV files linked to various bank applications, containing nearly 3.75 lakh records. In addition, JSON format files and 2,721 PDF files containing personally identifiable information were compromised, with portions of the stolen data later surfacing on the dark web.
The breached files contained personal details of SBI customers, loan application records, new account opening forms, contact numbers, and residential addresses. Investigators noted that such personally identifiable information could be exploited by cybercriminals for financial fraud and phishing attacks. Police are currently working to establish how the attackers gained access to the server, identify those behind the breach, and determine the motive for publishing the records on the dark web.
Bank Response and Warnings from Cyber Experts
Bank officials informed the police that SBI’s internal team launched an immediate probe after the stolen data appeared on the dark web. The bank has maintained that the leaked material was subsequently removed from the dark web and that its internal inquiry found no evidence of data misuse. Given the gravity of the breach, the bank approached the police to seek a formal investigation.
Despite the bank’s assurances, cybersecurity experts have urged customers to remain vigilant. Cyber law and privacy expert Advocate Prashant Mali noted that the removal of data from the dark web does not guarantee that copies do not exist elsewhere. He pointed out that hackers may have already sold the stolen records to other individuals or groups, making it difficult to confirm that the information will not be misused in the future.
Experts have advised bank customers to exercise caution against suspicious phone calls, emails, and text messages in the coming days. Fraudsters could use the leaked personal details to impersonate bank officials and target account holders. By referencing specific account details, KYC updates, loan applications, or transactions, criminals may attempt to deceive customers into sharing one-time passwords, account passwords, and other confidential credentials.
Police Investigation and Banking Security Concerns
The CBD-Belapur police have registered the case under relevant sections of the Bharatiya Nyaya Sanhita (BNS) pertaining to theft and criminal conspiracy, alongside provisions of the Information Technology Act. The FIR names unidentified persons who allegedly accessed the server through the ‘Siriasim’ hacker group and a specific IP address.
Investigating agencies are currently examining the relevant IP address, server logs, digital footprints, and the files published on the dark web to trace the source of the attack and identify the culprits. Authorities are also seeking to determine how many copies of the stolen files were created and whether they were shared with other cybercriminal networks. The incident has raised broader questions regarding customer data protection and cyber resilience within the banking sector, as the potential risks from a breach of this scale can persist long after dark web listings are taken down.
