SBI files police case over theft of 3.75 lakh records from its Global IT Centre, a month after the data surfaced on the dark web

Navi Mumbai police registered an FIR on 12 November 2026 at the CBD-Belapur police station over a breach at the State Bank of India's Global IT Centre, The Times of India, The Economic Times and Mirror Now report. The complaint was filed by SBI official Bhavesh Nikam. It says unknown persons operating under the hacker group name 'Siriusim' illegally accessed a server at the centre between 10 and 15 October; Hindustan Times, citing the same FIR, puts the window at 9 to 15 October.

According to the complaint as reported, the attackers took about 32 CSV files holding 3.75 lakh records from SBI applications, along with JSON files and 2,721 PDF documents containing personally identifiable information. Hindustan Times reports that 658 of those PDFs were duplicates and that the haul included around 4,280 customer records with personal data. The files covered personal details, loan application records, account opening forms, contact numbers and home addresses, and some of the data was later published on the dark web.

The case is filed under sections 303(2) (theft) and 61(2) (criminal conspiracy) of the Bharatiya Nyaya Sanhita and sections 43(a), 43(b), 43(c), 66 and 66C of the Information Technology Act, which cover unauthorised access, data extraction and identity theft. Senior inspector Arun Pawar told The Times of India that the bank's officials say they removed the stolen data from the dark web and ensured it has not been misused. Cyber law expert Prashant Mali, quoted by The Economic Times, said taking data down does not mean it was not already copied or sold, and advised customers to watch for phishing.

The FIR moves the story on from October, when Moneycontrol first reported the Siriusim group's claim of 3.75 lakh records and 2,722 documents. In a stock exchange filing dated 21 October, reported by The Hacker News, SBI said it had found 3,897 customer records with personal information in a set of about 375,000 records on the dark web, that the alert came on 16 October from its threat intelligence provider, CERT-In and the Defence Cyber Agency, and that it had hired a CERT-In empanelled firm to assess what it then called an alleged compromise, with no material impact on its operations. That filing did not say where the data came from. The police complaint now places the theft on a server at the bank's own IT centre.

For customers the practical risk is impersonation: callers or messages that quote a name, mobile number, address and loan details to sound like the bank. SBI has not said publicly whether affected customers will be told individually. Its standing advice is to report suspected fraud to [email protected] or the national cybercrime helpline, 1930.