# SBI Data Breach Claim – Threat Actor 'Siriusim' Alleges Access to 375,000-Row Customer Database on BreachForums

> A threat actor using the name Siriusim claims on BreachForums to hold State Bank of India (and potentially subsidiary) customer data: 375,000 CSV rows and 2,722 PDF files with KYC records, Aadhaar numbers, loan applications and account-opening forms. The claim is unverified; SBI had not responded at the time of reporting and no intrusion vector has been identified.

- **Published:** 2026-10-20T05:02:27Z
- **Last reviewed:** 2026-10-20T05:30:10.927Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3927
- **ID:** TL-2026-3927
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** TRACKING
- **Actor:** Siriusim
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-16 the monitoring account CyberPulse56 reported on X that a BreachForums actor named Siriusim was advertising a dataset allegedly belonging to State Bank of India (SBI) and potentially its subsidiaries. The actor described the material as the first disclosure of the dataset and claimed it consists of roughly 375,000 CSV rows (3.75 lakh) plus 2,722 PDF documents. Four sample customer records were published freely.

The claimed content spans loan applications and supporting documents, account-opening forms, KYC records, Aadhaar numbers and residential addresses. Free Press Journal's review of the samples listed further fields: names, dates of birth, mobile numbers, email addresses, occupations, nominee details, bank branch information, CKYC numbers, VKYC verification details, IFSC codes, and employment/income and salary declarations. Free Press Journal reported that sampled phone numbers were valid and that one WhatsApp profile picture matched a KYC photograph, which lends some weight to the samples being real personal data, but does not establish provenance, freshness or that the data originated from SBI.

Authenticity, source and extent remain unverified. Multiple outlets state that the origin could not be traced to SBI, its subsidiaries or service providers (including third-party processors), that a row count does not equal a count of unique individuals, and that no reporting identifies an exploited flaw, stolen credential or compromised server. SBI had not addressed the claims when India Today published on 2026-10-19, and had not replied to phone and email requests from Free Press Journal. No price, contact channel, IOC or malware was published in the sources.

Defensive relevance: if genuine, data of this type (KYC, Aadhaar, addresses, income details) supports identity fraud, targeted phishing and bank-officer impersonation. Reporting recommends customers never share passwords or OTPs, refuse unsolicited requests for financial information, avoid unexpected attachments and monitor statements. Prior Cybersecurity News coverage notes ongoing SBI-branded fraud (fake reward apps and fraudulent YONO deactivation alerts), which attackers could combine with leaked personal data. MITRE mappings below describe the claimed data theft/exposure at a generic level and the downstream abuse risks stated in the sources; they are not evidenced intrusion techniques. Severity is provisional pending SBI or independent confirmation.

## MITRE ATT&CK

- T1213 Data from Information Repositories
- T1048 Exfiltration Over Alternative Protocol
- T1589 Gather Victim Identity Information
- T1598 Phishing for Information
- T1566 Phishing
- T1657 Financial Theft
- T1656 Impersonation

## Sources

- [SBI Data Breach Claim – Hackers Allegedly Claim Access to 3.75 Lakh Users' Database (Cybersecurity News)](https://cybersecuritynews.com/sbi-data-breach-claim/)
- [SBI, Subsidiaries' Customer Data Allegedly On Dark Web: 3.75 Lakh Records, 2,722 Documents Claimed (Free Press Journal)](https://www.freepressjournal.in/business/sbi-subsidiaries-customer-data-allegedly-on-dark-web-375-lakh-records-2722-documents-claimed-in-data-breach)
- [Hacker Group Claims Access to Data of 3.75 Lakh SBI Customers (The420.in)](https://the420.in/sbi-data-breach-claim-customer-records-exposed/)
- [SBI Customer Data Leak Claim Appears Online, Still Unverified (SQ Magazine)](https://sqmagazine.co.uk/sbi-data-breach-claim/)
- [Hacker Group Claims Data Breach Exposing Records of 375,000 State Bank of India Customers (OODAloop)](https://oodaloop.com/briefs/cyber/hacker-group-claims-data-breach-exposing-records-of-375000-state-bank-of-india-customers/)
- [SBI Faces Unverified Claims of 375,000-User Data Breach (Whalesbook)](https://www.whalesbook.com/news/English/bankingfinance/SBI-Faces-Unverified-Claims-of-375000-User-Data-Breach/6ad6773179a16deaeaf73ec9)
- [12,000 SBI employees' sensitive data leaked on Telegram channels (Business Today)](https://businesstoday.in/technology/news/story/12000-sbi-employees-sensitive-data-leaked-on-telegram-channels-389239-2023-07-11)
- [SBI's 3.75 Lakh Customer Data Leak Claim Sparks Alarm (VARINDIA)](https://www.varindia.com/news/sbi-3-75-lakh-customer-data-leak-claim-sparks-alarm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3927