State Bank of India says it found personal data of 3,897 customers among about 3.75 lakh records reportedly circulating on the dark web, raising fresh data-protection questions.

BulletsIn

• SBI reported that 3,897 customer records containing personal information were identified among nearly 3.75 lakh records reportedly available on the dark web.
• The bank received alerts from cybersecurity agencies about the suspected exposure of customer information.
• The identified records contained names, mobile numbers, birth dates, email IDs, addresses and banking-related identifiers.
• SBI activated its cyber incident response system after the alerts.
• The bank also appointed an independent cybersecurity agency to investigate the matter.
• The incident raises questions about digital privacy, financial cybersecurity, incident response and customer protection.
• The Digital Personal Data Protection Act, 2023 is the central statute governing the handling of such personal data.
• CERT-In is the national agency for responding to cybersecurity incidents.
• The right to privacy was recognised as part of Article 21 in the Justice K.S. Puttaswamy judgment of 2017.

Tags: SBIDataBreach, DPDPAct, CyberSecurity