Threat reportData BreachTL-2026-3927
SBI Data Breach Claim – Threat Actor 'Siriusim' Alleges Access to 375,000-Row Customer Database on BreachForums
SBI Data Breach Claim (TL-2026-3927) is a medium-severity data breach, first published 2026-10-20. It is attributed to Siriusim with low confidence, affects State Bank of India Customer KYC, loan application and account-opening, maps to 7 MITRE ATT&CK techniques (T1048, T1213, T1566), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 1Siriusim
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3927
- Threat ID
- TL-2026-3927
- Severity
- MEDIUM
- Status
- TRACKING
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution
- Siriusim
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- finance, banking
- Target regions
- india
- Detection rules
- 9
- Indicators of compromise
- 14
- Updates
- 2026-10-20 · revalidated 1× · latest source
How SBI Data Breach Claim works
A threat actor using the name Siriusim claims on BreachForums to hold State Bank of India (and potentially subsidiary) customer data: 375,000 CSV rows and 2,722 PDF files with KYC records, Aadhaar numbers, loan applications and account-opening forms. The claim is unverified; SBI had not responded at the time of reporting and no intrusion vector has been identified.
On 2026-10-16 the monitoring account CyberPulse56 reported on X that a BreachForums actor named Siriusim was advertising a dataset allegedly belonging to State Bank of India (SBI) and potentially its subsidiaries. The actor described the material as the first disclosure of the dataset and claimed it consists of roughly 375,000 CSV rows (3.75 lakh) plus 2,722 PDF documents. Four sample customer records were published freely.
The claimed content spans loan applications and supporting documents, account-opening forms, KYC records, Aadhaar numbers and residential addresses. Free Press Journal's review of the samples listed further fields: names, dates of birth, mobile numbers, email addresses, occupations, nominee details, bank branch information, CKYC numbers, VKYC verification details, IFSC codes, and employment/income and salary declarations. Free Press Journal reported that sampled phone numbers were valid and that one WhatsApp profile picture matched a KYC photograph, which lends some weight to the samples being real personal data, but does not establish provenance, freshness or that the data originated from SBI.
Authenticity, source and extent remain unverified. Multiple outlets state that the origin could not be traced to SBI, its subsidiaries or service providers (including third-party processors), that a row count does not equal a count of unique individuals, and that no reporting identifies an exploited flaw, stolen credential or compromised server. SBI had not addressed the claims when India Today published on 2026-10-19, and had not replied to phone and email requests from Free Press Journal. No price, contact channel, IOC or malware was published in the sources.
Defensive relevance: if genuine, data of this type (KYC, Aadhaar, addresses, income details) supports identity fraud, targeted phishing and bank-officer impersonation. Reporting recommends customers never share passwords or OTPs, refuse unsolicited requests for financial information, avoid unexpected attachments and monitor statements. Prior Cybersecurity News coverage notes ongoing SBI-branded fraud (fake reward apps and fraudulent YONO deactivation alerts), which attackers could combine with leaked personal data. MITRE mappings below describe the claimed data theft/exposure at a generic level and the downstream abuse risks stated in the sources; they are not evidenced intrusion techniques. Severity is provisional pending SBI or independent confirmation.
MITRE ATT&CK techniques used in TL-2026-3927
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Collection
T1213 Data from Information Repositories
Initial Access
Reconnaissance
T1589 Gather Victim Identity Information; T1598 Phishing for Information
Defense Evasion
Impact
Affected products and versions in SBI Data Breach Claim
- State Bank of India — Customer KYC, loan application and account-opening records (alleged; source system unconfirmed)
Remediation for SBI Data Breach Claim
Immediate actions
- Monitor BreachForums and other leak venues for Siriusim postings and any SBI-branded dataset
- Alert SBI and subsidiaries' security contacts and request confirmation or denial of the claim
- Warn customers and staff not to share passwords or OTPs and to refuse unsolicited financial information requests
- Block and report SBI-impersonating phishing domains, fake reward apps and fake YONO deactivation alerts
Workarounds
- Customers should monitor transaction statements regularly and treat unexpected bank-officer contact with suspicion
- Do not open unexpected attachments
Longer-term hardening
- Audit third-party processors and subsidiaries handling loan applications, account-opening forms and KYC documents
- Apply data-minimization and access logging to repositories holding KYC and Aadhaar documents
- Add DLP monitoring for bulk CSV/PDF exports of KYC and loan data
Timeline of SBI Data Breach Claim
- Business Today reports an earlier, unrelated SBI-linked exposure (sensitive data of about 12,000 SBI employees circulating on Telegram channels); historical context only, no link to Siriusim established
- Siriusim advertises the alleged SBI dataset (375,000 CSV rows, 2,722 PDFs, four free samples) on BreachForums; CyberPulse56 reports it on X
- Free Press Journal reports sampled phone numbers were valid and one WhatsApp profile photo matched a KYC photograph; SBI did not respond to calls or email
- VARINDIA reports the claim and notes it is unverified, with no established recency and no confirmation that the data is not recycled from earlier incidents.
- SQ Magazine and OODAloop publish coverage stressing the claim is unproven and no exploited flaw, stolen login or compromised server is identified
- India Today reports that SBI had not addressed the claims and the source and authenticity could not be verified
- Cyberpress and GBHackers publish analyses. Cyberpress describes visible field labels (lead identifiers, processing status, error codes, eKYC, debit data, nested JSON) and credit-based access to the post. Authenticity, origin and intrusion vector remain unverified.
- Cybersecurity News and The420.in publish; still no official SBI statement and origin (SBI, subsidiary or third-party processor) unconfirmed
- Free Press Journal and The420.in note SBI had not responded and no forensic confirmation of system compromise exists; no price or contact channel disclosed; victims directed to report cybercrime via 1930 or cybercrime.gov.in
Update history for TL-2026-3927
- 2026-10-20 — SBI Data Breach Allegedly Exposes Personal Information of 3.75 Lakh Users (Actor: Siriusim) - Unverified Claim: What changed No severity, exploitability, status or attribution change. Severity stays MEDIUM, exploitability NONE, status TRACKING. The report adds dataset detail and a recycled-data caveat. New indicators (3) 3 behavioral indicators: cred
Sources cited for SBI Data Breach Claim
- SBI Data Breach Claim – Hackers Allegedly Claim Access to 3.75 Lakh Users' Database (Cybersecurity News)
- SBI, Subsidiaries' Customer Data Allegedly On Dark Web: 3.75 Lakh Records, 2,722 Documents Claimed (Free Press Journal)
- Hacker Group Claims Access to Data of 3.75 Lakh SBI Customers (The420.in)
- SBI Customer Data Leak Claim Appears Online, Still Unverified (SQ Magazine)
- Hacker Group Claims Data Breach Exposing Records of 375,000 State Bank of India Customers (OODAloop)
- SBI Faces Unverified Claims of 375,000-User Data Breach (Whalesbook)
- 12,000 SBI employees' sensitive data leaked on Telegram channels (Business Today)
- SBI's 3.75 Lakh Customer Data Leak Claim Sparks Alarm (VARINDIA)
Detection coverage for TL-2026-3927
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3927 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.