Desk note · industry · Banking / cybersecurity
Reporting on 20 October 2026 said a threat actor called Siriusim claimed to have published 375,000 CSV rows and 2,722 PDF documents with personal and loan-related details tied to State Bank of India customers; SBI had not publicly confirmed the leak and the authenticity of the data remained unverified.
On 20 October 2026, Mint cited cybersecurity monitors who said a threat actor using the name Siriusim claimed to have leaked customer information tied to State Bank of India. The post, surfaced by the CyberPulse56 account on X, dated the alleged release to 16 October 2026. The claimed cache includes about 375,000 comma-separated rows and 2,722 PDF files with personal details, loan applications, supporting documents, addresses, and other onboarding paperwork. The actor described it as a first tranche and did not explain how the files were obtained. Reporters noted that the authenticity of the dump and any breach at SBI were unverified, and the bank had not issued a public confirmation by the time the story ran. The headline sits beside wider October warnings that Indian lenders and fintech partners face credential-theft attacks on payment APIs.
Even unverified leak claims can trigger phishing waves if criminals reuse real-looking account numbers or old application forms. Banks typically investigate by matching sample records to internal logs, rotating API keys, and alerting regulators if personal data is confirmed exposed. Customers should treat unexpected loan-offer calls or KYC reset messages as suspicious until the bank publishes official guidance. For the sector, the episode adds pressure on state-run and private lenders to tighten vendor access, log retention, and breach disclosure timelines under India’s digital personal data rules.
If you bank with SBI or recently applied for a loan there, watch only official SMS, app, and website notices before sharing OTPs or documents. Enable transaction alerts, change passwords if you reused them on third-party sites, and report unfamiliar credit inquiries. If you work at a lender or fintech, rerun API key reviews and partner-bank credential maps in light of CERT-In’s 9 October advisory. Track any SBI exchange or regulator statement, police cyber-cell updates, and whether CERT-In elevates the incident from social-media claim to confirmed breach.
Telecom / IPO
On 22 October 2026, exchange data showed Jio Platforms’ ₹30,213 crore issue had drawn about ₹3.73 lakh crore of total bids by late evening on Day 2, with the retail portion oversubscribed and market commentators citing diverted cash from other listed stocks during the book build.
SEBI / market infrastructure
On 22 October 2026, the Securities and Exchange Board of India proposed letting stock exchanges and depositories fund core-market and regulator-mandated initiatives without prior approval for each ticket, while keeping board oversight and financial safeguards and inviting comments until 12 November.
E-commerce / food delivery
On 22 October 2026, reporting said Flipkart is testing an internal food delivery product called Eat-in by Minutes with more than 8,000 employees in Bengaluru, using Ekart logistics as it prepares to compete with Zomato and Swiggy in meal delivery.
Digital trust / compliance
On 22 October 2026, eMudhra Ltd said its board will voluntarily withdraw from the global SSL/TLS certificate segment after a key-security incident on eight intermediate certificates, citing compliance cost and weak economics while stressing that other digital-trust services continue.
For informational purposes only. Not investment advice. Verify with filings and a licensed adviser.