State Bank of India says it found 3,897 records with customers' personal details on the dark web and has started a cybersecurity investigation.

The bank got the first alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency and CERT-In.

Of about 3.75 lakh records it checked, 3,897 held details such as mobile numbers, dates of birth, names, email addresses and home addresses.

The records also held branch and customer file identifiers, lead IDs and metadata linked to loan records, the bank's filing said.

A threat actor called "Siriusim" had claimed on BreachForums to have 3.75 lakh SBI customer records and 2,722 PDF documents. The claim is unverified.

SBI has hired an independent agency empanelled with CERT-In to check whether the records are genuine and trace the source.

The bank said it expects no material impact on its IT systems, core operations or finances, and core functions are running normally.

Customers should be careful with unsolicited calls claiming to be from SBI and should not share OTPs or card details on such calls.

Read the full article for more on the SBI data leak.