SBI weighs data leak impact, alerts cyber cover provider

SBI said it examined the records available on the dark web and identified 3,897 customer records containing personally identifiable information.

SBI may seek a claim under a Rs 1,425-crore cyber insurance policy with Oriental Insurance following a suspected leak of customer data, people familiar with the matter told ET. "SBI is in the process of notifying the insurer about the claim," said a person aware of the development.

Both SBI and state-run Oriental Insurance did not respond to requests for comment.

The country's largest mass lender is investigating a data security incident after a threat actor group reportedly leaked around 375,000 rows of data and 2,722 PDF documents on the dark web.

Any insurance claim would depend on the policy's terms and conditions, the nature of the incident and the losses, if any, found to be covered. The Rs 1,425-crore limit is the coverage ceiling.

"A well-drafted cyber insurance policy may also cover certain liabilities and expenses arising from data protection law violations, depending on its wording and applicable law," said an insurance broker. "However, coverage for regulatory fines can be subject to restrictions and exclusions, making policy terms important."

SBI said it examined the records available on the dark web and identified 3,897 customer records containing personally identifiable information. The exposed information reportedly includes names, mobile numbers, dates of birth, email addresses, residential addresses and details linked to loan applications.

The bank has activated its cyber incident response procedures and appointed an independent cybersecurity agency empanelled by the CERT-In to investigate the incident.