A civil society organisation has put India's largest bank on notice over what it says is a troubling gap: customers whose personal information may have been exposed have not been told so directly. The Internet Freedom Foundation (IFF) says SBI's public disclosure about a suspected data exposure fails to confirm whether a single affected customer has actually been contacted. That omission, the group argues, strikes at the heart of what a data breach response is supposed to achieve.
What triggered the concern
The controversy stems from claims circulating on the platform X, where an entity calling itself "Siriusim" asserted it had released close to 3.75 lakh rows of data linked to SBI, along with 2,722 PDF documents reportedly containing loan applications and account-opening forms. Such documents, if genuine, often carry sensitive financial and identity details - the kind of material that can be weaponised for targeted fraud, phishing, or identity theft. IFF has not independently verified the claim, and nor can this account, but it argues that the mere plausibility of such exposure obliges the bank to respond with clarity rather than ambiguity.
Why direct notification matters
A breach disclosure that informs the public in general terms, without confirming individual notification, leaves customers unable to judge their own risk. Someone whose loan application or KYC documents were exposed faces a materially different threat than someone unaffected altogether. Without being told, both are left equally in the dark - unable to watch for suspicious calls, change compromised credentials, or flag unusual account activity. IFF's demand that SBI communicate in English, Hindi and the customer's branch language, through SMS, email and post, reflects a basic principle of breach response practised in many jurisdictions: affected individuals must be told what happened to their specific data, not just informed that "an incident occurred."
The regulatory gap
Part of what makes this episode significant is timing. India's Digital Personal Data Protection Act, 2023, along with its 2025 Rules, contains provisions - Section 8(6) and Rule 7 - that would legally require entities handling personal data to notify affected individuals and the Data Protection Board following a breach. These provisions are not yet in force. Until they are, there is no binding statutory deadline compelling any company, bank included, to tell customers their data has leaked. IFF's call for the Ministry of Electronics and Information Technology to operationalise these sections immediately, and for the Reserve Bank of India to issue interim directions to all regulated entities in the meantime, points to a regulatory vacuum that incidents like this one expose in real time.
What accountability would look like
IFF's demands extend beyond notification. It wants SBI to specify what the leaked records actually contain - whether Aadhaar, PAN or passport copies are among them - and how many customers are implicated. It also wants the bank to eventually disclose how the data left its systems, including whether a third-party vendor or direct selling agent was involved, a detail that would clarify where the security failure originated. Financial institutions routinely rely on external partners for loan sourcing and onboarding, and such partnerships have repeatedly proven to be weak links in data security chains across sectors.
- Affected customers notified individually, in relevant languages, via multiple channels
- A dedicated helpline and online tool to check exposure status
- Full disclosure of what the leaked records contain and how many people are affected
- Public findings once the investigation into the breach's origin concludes
- Immediate enforcement of DPDP notification provisions by the government
Until these questions are answered, customers are left to assume the worst or assume nothing at all - both unsatisfactory outcomes when financial identities are potentially at stake.
