look news india
A shocking incident has come to light regarding the security of account holders of State Bank of India (SBI), the country’s largest government bank, which has created a sensation in the banking system across the country. Serious questions have been raised on the cyber security and digital infrastructure of the bank after it was confirmed that sensitive personal information of 3,897 customers was available on the dark web. The news that this data includes customers’ names, mobile numbers and residential addresses has increased the concern of account holders. As soon as this matter became public, the bank management immediately came into action and issued an official statement clarifying the entire situation in the regulatory filing given to the stock exchange. The bank has initiated a comprehensive forensic investigation into the matter in collaboration with security agencies to ascertain whether the data was leaked from the bank’s own servers or from the systems of an external third-party vendor.
This whole incident started when a huge dataset of about 3.75 lakh records was found floating on the hacking forum of the dark corner of the internet i.e. Dark Web. When the Indian Computer Emergency Response Team (CERT-In), Defense Cyber Agency and the bank’s own threat intelligence service provider issued an alert on this data, the bank conducted a preliminary analysis of it. The investigation found that 3,897 records in those files were directly linked to sensitive personally identifiable information (PII) of actual customers. The leaked dataset includes highly personal information of customers like full name, gender, registered mobile number, date of birth, email ID, address, bank branch and customer information file (CIF) code. Apart from this, technical metadata related to loan and lead records was also present in this data, which is often used by cyber criminals for phishing and social engineering attacks.
After the matter came to light, the biggest question was whether there is any direct threat to the money deposited in the bank accounts of the affected customers? On this, State Bank of India clearly said that this incident has not had any physical or financial impact on the core banking operations of the bank. The bank’s systems are working completely normally. According to official information, the data that has come out does not include any authentication related information like customers’ net banking password, UPI PIN, ATM PIN or OTP. This means that no hacker can directly withdraw money from a customer’s account just through this leaked data. However, cyber security experts believe that by taking the help of information like name, mobile number and address, fraudsters can call customers posing as bank officials and try to make them victims of fraud by luring them with fake loans or KYC updates.
Considering the seriousness of the matter, SBI has implemented Emergency Cyber Incident Response Protocol. The bank has clarified that a detailed investigation is being conducted to identify the authenticity of the leaked data, its full scope and its source. For this, an independent external cyber security agency approved by CERT-In has been entrusted with the responsibility of technical audit and forensic investigation. According to initial assessment, hackers may have obtained this data by taking advantage of a weak link or API configuration flaw in the system. The Bank is taking all mandatory steps as per regulatory norms and has further tightened its internal firewalls and data monitoring systems to completely prevent such breaches in future.
Although the bank has denied any direct financial loss, whenever a customer’s personal data comes into the public domain, the risk of cyber fraud increases manifold. In such times, there is a strong need for account holders to be extra cautious. If you receive any call, message or WhatsApp notification in the name of the bank asking you to click on a link in the name of updating PAN card, pending electricity bill or encashing reward points, then do not trust it even by mistake. Always remember that no bank employee asks you for OTP, password or CVV number over the phone. Keep changing your banking passwords from time to time, keep two-factor authentication on and avoid sharing your financial information on any unknown calls. If any suspicious transaction is seen in any account, immediately lodge a complaint on the bank’s official helpline number 1930 or on the National Cyber Crime Reporting Portal.