State Bank of India (SBI), one of the country's largest public sector banks, has admitted that customer data was leaked. SBI said that there was a cyber attack on its system, in which personal information of 3,897 customers was put on the dark web. The news of customers' personal information being exposed on the dark web has increased concerns about banking security. Meanwhile, the bank has claimed that this cyber attack will not have any impact on the functioning of the bank.
It is being told that on October 16, SBI got information about cyber attack on its customer data. The bank said that its threat intelligence service provider 'Defence Cyber Agency' and 'Indian Computer Emergency Response Team' (CERT-In) had alerted it about the breach in customer data. According to the SBI statement, the bank conducted an initial investigation of about 3.75 lakh records, out of which personal information related to the identity of customers was found in 3,897 records.
Also read: Which mistakes of Election Commission is Congress counting on SIR, why mentioning Pilibhit?
What is dark web?
First of all it is important to understand what dark web is. This is a part of the Internet which is not easy to search directly on a normal search engine like Google. Some people use it to share information on the internet by hiding their identity, while cyber criminals sell the stolen data here or share it with anyone.
What customer information was leaked?
According to reports, the suspicious data includes information like customers' names, registered mobile numbers, dates of birth, gender, email IDs and home addresses. Apart from this, information related to the bank's branch, CIF number, Lead ID and metadata of records related to loan or loan application has also been revealed. The CIF number helps to identify the customer and organize records related to him in the bank's system, while the Lead ID may be related to a customer's inquiry or application for a financial product.
After all, how did the data reach the dark web?
The most important question in this matter is how the customer information got out. At present, the real reason for the data leak has not been made public in the SBI investigation. Possible causes could include a system breach, misuse of data held by an employee or external service provider, or a lack of security in a database containing customer information. Data may also be held by different systems or service providers during loan applications, customer verification and other processes in banking services.
How big is the risk to customers?
The biggest danger of such data leaks can come in the form of online fraud and phishing. For example, if a fraudster has the customer's name, mobile number and loan related information, he can call him pretending to be a bank employee. He can use the personal information of the customer to trust him and then ask for OTP, ATM PIN, password or other private details. However, the information currently available does not prove that the fraudsters have withdrawn money from the accounts of SBI customers or gained unauthorized access to the bank's core banking systems. SBI has said that this incident has not had any major impact on its core business, financial performance or general functioning.
Also read: Thieves took away umbrella and crown from Sai Baba temple late at night, priests remained asleep
What is SBI doing?
SBI has activated its response and containment protocols to deal with the cyber incident and has appointed an independent cyber security agency accredited by CERT-In for investigation. The purpose of the investigation is to find out how genuine and complete the data is, where it came from and what risks it may pose to customers. In the meantime, customers should remain cautious of unknown phone calls, suspicious SMS, emails and WhatsApp messages. Do not share OTP, ATM PIN, UPI PIN or net banking password with anyone and do not click on suspicious links sent in the name of the bank.