State Bank of India (SBI) Dark-Web Data Leak

Syllabus: GS3/Cybersecurity

Context

• The State Bank of India (SBI) has disclosed that it is investigating a cybersecurity incident involving the suspected exposure of customer data on the Dark Web.

Dark Web

• The dark web is the part of the internet where users can access unindexed web content anonymously through special web browsers like The Onion Router (Tor). 
• Origin: The foundational technology was developed by researchers at the U.S. Naval Research Laboratory (NRL).
  • It was designed to protect American intelligence communications and obscure online activity from monitoring and interception.
• Concerns: The dark web is unregulated, meaning that it is run and upheld by a vast network of individuals around the world. 

Implications of the Data Breach

• Targeted financial fraud: Fraudsters can use personal details to impersonate bank officials and make fraudulent calls or messages appear credible.
• Identity theft and privacy violations: Exposed personal information may be used for impersonation, phishing and other forms of misuse.
• Erosion of public trust: Data breaches can weaken customer confidence in digital banking and financial institutions.

Legal Frameworks Related to Data Protection

• Digital Personal Data Protection (DPDP) Act, 2023:
  • Section 8(6): It requires organisations to inform the Data Protection Board of India and affected individuals about a personal data breach.
  • DPDP Rules, 2025: Rule 7 explains how organisations must inform affected individuals about a data breach and the steps they can take to protect themselves.
  • Implementation: These provisions are scheduled to come into force on 13 May 2027. Therefore, this specific legal requirement to notify affected individuals was not yet in force at the time of the SBI incident.
• CERT-In Directions, 2022: The Indian Computer Emergency Response Team (CERT-In) is the national agency responsible for reacting to cyber security incidents under Section 70B of the Information Technology Act, 2000.
• RBI Cybersecurity Framework: The Reserve Bank of India has prescribed Cybersecurity governance, incident reporting and risk assessment and security policies for the regulated organisations.

Initiatives taken by the government

• Samanvaya Platform: Developed by the Ministry of Home Affairs (MHA), it serves as a Management Information System (MIS), data repository and coordination platform for Law Enforcement Agencies (LEAs) to facilitate cybercrime data sharing and analytics.
• Indian Cyber Crime Coordination Centre (I4C): Established under the Ministry of Home Affairs to strengthen coordination among agencies in tackling cybercrime.
• Cyber Swachhta Kendra: Aims to detect and help remove malicious software from devices and improve cybersecurity awareness.

Way Ahead

• Improve data protection: Encryption, multi-factor authentication, secure configuration management and regular audits should be strengthened.
• Ensure customer awareness: Banks should promptly communicate relevant risks to affected customers and provide clear guidance on identifying fraudulent calls and messages.
• Strengthen accountability: Investigations should establish the source and extent of data exposure and ensure that corrective measures are implemented.

Source: TH