Threat Actor Claims Leak of 375,000 Records Allegedly Linked to SBI

A threat actor operating under the alias "Siriusim" posted a listing on BreachForums claiming to have hacked 375,000 customer records (3.75 lakh rows in CSV format) and 2,722 PDF documents allegedly linked to the State Bank of India (SBI) and potentially its subsidiaries. The alleged dataset primarily involves loan applications, savings account applications, and Know Your Customer (KYC) records, with four sample records examined by The Free Press Journal containing names, dates of birth, mobile numbers, residential addresses, Central KYC (CKYC) numbers, video KYC (VKYC) verification fields, IFSC details, and an employment and income declaration form listing salary details. Independent checks on the four publicly released samples confirmed that the listed mobile numbers were valid, and one phone number's WhatsApp profile picture matched the passport-size photograph attached to that individual's leaked KYC document. While the samples correspond to real individuals, the verification does not independently establish that the full 375,000-row dataset is genuine, how it was obtained, or whether the records belong directly to SBI, its subsidiaries, or third-party service providers handling banking applications. The claim was highlighted on X on October 16, 2026, by cybersecurity account CyberPulse56, and SBI had not responded to phone and email inquiries from The Free Press Journal at the time of publication.