SBI leak put Central KYC numbers on BreachForums

State Bank of India told India’s National Stock Exchange that 3,897 customer records had leaked online. The BreachForums post, published by a new account called “Siriusim,” contained a table with 375,000 rows and 2,722 PDF files. SBI’s compliance and company secretary did not say whether the 3,897 figure counted individuals, and neither of the hacker’s numbers maps cleanly to a headcount either. To customers, the bank described the incident as affecting “a very, very small number” of them.

For an institution serving more than 500 million people, a few thousand records is small, about 0.0008% of its customer base. The content of those records is what makes the leak worth attention.

SBI acknowledged the data included names, genders, mobile numbers, email addresses, home addresses, dates of birth, bank profile IDs, and loan metadata, plus “other files.” Reporting out of Mumbai filled in the rest: Central KYC numbers, the single identifier tied to a person’s financial accounts across India, along with video KYC verification data and the documents people submit to open an account or apply for a loan. One published file was an employment and income declaration listing the person’s employer, work experience, and salary. Mumbai’s Free Press Journal verified samples against real Indian citizens, including a case where the WhatsApp photo on a leaked mobile number matched the passport photo in the same person’s KYC file.

That mix matters more than the row count. A leaked email address or phone number ages quickly and already sits in a hundred other dumps. KYC data does not age. Independent researcher Sushant Bhardwaj noted that KYC details are hard to change, so they support identity fraud: applying for credit in someone’s name, or answering the verification questions a bank uses to confirm who it is talking to. Loan metadata adds a sharper angle. A caller who can quote a borrower’s real loan details can pose as the bank or a recovery agent and push for a “fee” or a one-time password. The practical risk is convincing phishing and vishing rather than direct account theft, and it is harder to defend against because the pretext checks out.

Brian Hussey at Cyderes, whose team last month documented an Indian data broker selling lookups for about five rupees, roughly six cents, through a Telegram bot and a business API, describes how a static dump interacts with that market. A breach dump goes stale the day it is posted. A lookup service stays current because it queries the authoritative source in real time. The two work together: the dump identifies who is worth targeting, say someone who applied for a sizable loan, and the live service enriches that person on demand, turning a mobile number into a subscriber identity, an employment history, and a list of registered vehicles.

Hussey’s enforcement point is the hard part. A lookup costs a few seconds and leaves no intrusion, no anomaly in the provider’s logs, and no accountable buyer. “You cannot investigate an event that never registers as one,” he says. A breach that would be a contained incident elsewhere becomes a fresh seed for an industry that can already answer most questions about an Indian citizen on demand.

SBI said its core business functions kept running without disruption, which together with the shape of the data points at a peripheral system rather than the main banking platform. The onboarding and loan-application path is exactly where KYC documents, income declarations, and video verification accumulate, and it usually gets less scrutiny than the systems holding balances. SBI’s last big exposure, in 2019, fit the same shape: a single server behind the “SBI Quick” notification system, sitting in a Mumbai data center without password protection, put millions of customers at risk. The exposed machine was peripheral tooling, not the ledger.

For anyone running these systems, the lesson is about where the sensitive data actually lives. KYC and onboarding pipelines collect the exact fields that cannot be rotated after a leak, and they frequently sit in less-guarded services around the core. Treat video KYC stores, document-upload buckets, and loan-origination databases as tier-one data. Inventory where completed KYC files persist after onboarding finishes, and delete the ones no longer needed for a live obligation, because every retained record is a permanent identifier feeding a market that stays current whether or not the breach that exposed it ever goes stale.

See also: NordVPN for tunneled traffic when operating outside controlled networks.

---

#ad Contains an affiliate link.