SBI Breach Feeds India's Thriving Underground PII Market

State Bank of India disclosed a breach affecting 3,897 customer records after an attacker posted stolen data to BreachForums. While this represents only 0.0008 percent of the bank’s 500+ million customers, the breach appears to stem from a peripheral system rather than core infrastructure, consistent with a 2019 incident where an unprotected server exposed millions. Journalists verified the leaked data as genuine, confirming it belonged to real Indian citizens.

The compromised data encompassed names, mobile numbers, email addresses, dates of birth, bank profile IDs, KYC (Know Your Customer) records, and loan metadata. While direct account theft is unlikely, security researchers highlight that the data enables sophisticated phishing, social engineering, and identity fraud. KYC details prove particularly valuable since they’re difficult to change and can be weaponized for fraudulent credit applications and account verification scams. Attackers posing as recovery agents can use loan metadata to pressure victims into sending money or sharing one-time passwords.

The true risk emerges from India’s underground market for PII, where brokers sell personal records for as little as 5 rupees per lookup through APIs and Telegram bots. Leaked SBI data becomes raw material for enrichment: attackers can query these services to transform minimal PII into comprehensive profiles including employment history and registered vehicles. This ecosystem operates with minimal detection—lookups create no logs or forensic signatures—making victim accountability virtually impossible. The interconnected nature of India’s identity systems means a breach in one place becomes immediately useful across the entire underground economy.