{"schema_version":"0.10.0","id":"LR-2026-0836","record_version":1,"title":"SBI customer data exposure on dark web, preceded by CERT-In warning on autonomous AI agents","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.76,"unhedged_language":3.65},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-04","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-04","history":[{"date":"2026-11-04","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"cddd36008a23f564c13a18a2e5384e8761ee9a35ba3ffe2a17df1538a1ceb72b"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-21","incident_class":"privacy_leakage","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"SBI, India's largest public lender, disclosed on 21 October 2026 a customer data exposure on the dark web involving personal records, loan applications and customer metadata. SBI learned of the breach on 16 October not internally but from external notices issued by CERT-In, the Defence Cyber Agency and a third-party threat intelligence vendor, after dark web claims had already circulated on social media. A preliminary review identified 3,897 compromised records containing PII, while external threat actors claimed over 375,000 entries and 2,722 loan documents. The article attributes the exposure to loosely monitored outsourced customer acquisition and direct selling agent pipelines. SBI issued no direct notices or advisories to affected account holders. The article notes the disclosure followed a CERT-In warning about autonomous AI agents penetrating enterprise networks.","tags":["data-breach","privacy","pii-exposure","dark-web-leak","third-party-vendor-risk","banking"],"date_detected":"2026-10-16","near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":"Previously, the CERT-In Advisory CIAD-2026-0049, warned that autonomous AI agents, both rogue research workloads and offensive open-source tools, have bypassed enterprise defences across Indian critical infrastructure."},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":3897,"third_parties_affected_count":null,"severity":"major","severity_because":"Major: a live production compromise of a bank's customer data with an unbounded scope stated, since threat actors claimed over 375,000 entries against 3,897 confirmed records.","harm_class":["privacy","financial"],"affected_description":"SBI account holders whose personal records, loan applications and customer metadata were exposed","protected_class_involved":null,"data_categories_exposed":["pii"],"loss_range_usd":null,"reversibility":"irreversible","downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.tradingview.com/news/moodys:b5c1358c8894d:0-sbi-data-breach-old-guards-new-threats/","publisher":"TradingView","date":"2026-11-03","type":"press","title":"SBI data breach: old guards, new threats","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.date_disclosed":"C","event.trigger":"D","event.detection_method":"C","event.summary":"C","event.tags":"C","event.date_detected":"C","event.precursor_events":"C","event.incident_class":"C","impact.records_exposed":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.reversibility":"C","impact.severity_because":"C","context.industry":"C","context.org_size_band":"C","context.country":"C","context.denominator_available":"D","context.regulatory":"C"},"field_citations":{"event.date_disclosed":[{"source_index":0,"quote":"The State Bank of India (SBI), the country's largest public lender, filed a regulatory disclosure on 21 October 2026, acknowledging a customer data exposure on the dark web, its primary audience was Dalal Street."}],"event.detection_method":[{"source_index":0,"quote":"Detection Failures and Delayed Reaction: SBI learned of the breach on 16 October not internally, but from external notices issued by CERT-In, the Defence Cyber Agency, and a third-party threat intelligence vendor."}],"event.summary":[{"source_index":0,"quote":"The State Bank of India (SBI), the country's largest public lender, filed a regulatory disclosure on 21 October 2026, acknowledging a customer data exposure on the dark web, its primary audience was Dalal Street."},{"source_index":0,"quote":"Detection Failures and Delayed Reaction: SBI learned of the breach on 16 October not internally, but from external notices issued by CERT-In, the Defence Cyber Agency, and a third-party threat intelligence vendor."},{"source_index":0,"quote":"While SBI's preliminary review identified 3,897 compromised records containing Personally Identifiable Information (PII), external threat actors claimed to hold over 375,000 entries and 2,722 loan documents."},{"source_index":0,"quote":"The presence of lead identifiers and loan application metadata strongly points to vulnerabilities in outsourced customer acquisition and direct selling agent (DSA) pipelines, where access controls and data-sanitization standards remain loosely monitored."},{"source_index":0,"quote":"Absence of Customer Notification: While SBI complied with exchange listing requirements under Sebi (LODR) regulations, it issued no direct notices, consumer advisories, or helplines to affected account holders."},{"source_index":0,"quote":"Interestingly, the declaration was preceded by a warning from the Indian Computer Emergency Response Team (CERT-In) regarding autonomous AI agents penetrating enterprise networks."}],"event.tags":[{"source_index":0,"quote":"While SBI's preliminary review identified 3,897 compromised records containing Personally Identifiable Information (PII), external threat actors claimed to hold over 375,000 entries and 2,722 loan documents."},{"source_index":0,"quote":"The presence of lead identifiers and loan application metadata strongly points to vulnerabilities in outsourced customer acquisition and direct selling agent (DSA) pipelines, where access controls and data-sanitization standards remain loosely monitored."},{"source_index":0,"quote":"The State Bank of India (SBI), the country's largest public lender, filed a regulatory disclosure on 21 October 2026, acknowledging a customer data exposure on the dark web, its primary audience was Dalal Street."}],"event.date_detected":[{"source_index":0,"quote":"Detection Failures and Delayed Reaction: SBI learned of the breach on 16 October not internally, but from external notices issued by CERT-In, the Defence Cyber Agency, and a third-party threat intelligence vendor."}],"event.precursor_events":[{"source_index":0,"quote":"Previously, the CERT-In Advisory CIAD-2026-0049, warned that autonomous AI agents, both rogue research workloads and offensive open-source tools, have bypassed enterprise defences across Indian critical infrastructure."}],"event.incident_class":[{"source_index":0,"quote":"While SBI's preliminary review identified 3,897 compromised records containing Personally Identifiable Information (PII), external threat actors claimed to hold over 375,000 entries and 2,722 loan documents."}],"impact.records_exposed":[{"source_index":0,"quote":"While SBI's preliminary review identified 3,897 compromised records containing Personally Identifiable Information (PII), external threat actors claimed to hold over 375,000 entries and 2,722 loan documents."}],"impact.severity":[{"source_index":0,"quote":"While SBI's preliminary review identified 3,897 compromised records containing Personally Identifiable Information (PII), external threat actors claimed to hold over 375,000 entries and 2,722 loan documents."}],"impact.harm_class":[{"source_index":0,"quote":"In India's banking environment, where social-engineering scams rely on accurate customer profiles, failing to alert individuals whose loan details, CIF numbers, and addresses were compromised leaves them directly exposed to targeted financial fraud."}],"impact.affected_description":[{"source_index":0,"quote":"The breach involving personal records, loan applications, and customer metadata signals possible institutional blind spots, Interestingly, the declaration was preceded by a warning from the Indian Computer Emergency Response Team (CERT-In) regarding autonomous AI agents penetrating enterprise networks."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"While SBI's preliminary review identified 3,897 compromised records containing Personally Identifiable Information (PII), external threat actors claimed to hold over 375,000 entries and 2,722 loan documents."}],"impact.reversibility":[{"source_index":0,"quote":"The State Bank of India (SBI), the country's largest public lender, filed a regulatory disclosure on 21 October 2026, acknowledging a customer data exposure on the dark web, its primary audience was Dalal Street."}],"impact.severity_because":[{"source_index":0,"quote":"While SBI's preliminary review identified 3,897 compromised records containing Personally Identifiable Information (PII), external threat actors claimed to hold over 375,000 entries and 2,722 loan documents."}],"context.industry":[{"source_index":0,"quote":"The State Bank of India (SBI), the country's largest public lender, filed a regulatory disclosure on 21 October 2026, acknowledging a customer data exposure on the dark web, its primary audience was Dalal Street."}],"context.org_size_band":[{"source_index":0,"quote":"The State Bank of India (SBI), the country's largest public lender, filed a regulatory disclosure on 21 October 2026, acknowledging a customer data exposure on the dark web, its primary audience was Dalal Street."}],"context.country":[{"source_index":0,"quote":"The State Bank of India (SBI), the country's largest public lender, filed a regulatory disclosure on 21 October 2026, acknowledging a customer data exposure on the dark web, its primary audience was Dalal Street."}],"context.regulatory":[{"source_index":0,"quote":"Absence of Customer Notification: While SBI complied with exchange listing requirements under Sebi (LODR) regulations, it issued no direct notices, consumer advisories, or helplines to affected account holders."},{"source_index":0,"quote":"However, the core enforcement provisions remain deferred under a staggered timeline until May 2027."}]},"notes_on_gaps":"The article is an opinion/analysis piece about a data breach; it does not state that an AI agent caused the SBI breach. The CERT-In advisory on autonomous AI agents is cited as context and as a prior warning, not as the mechanism of this incident, so agent_involved is false and failure_class is null. The article does not state the date the breach occurred, only that SBI learned of it on 16 October 2026 and disclosed on 21 October 2026. The 3,897 figure is SBI's preliminary confirmed count; the 375,000 entries and 2,722 loan documents are threat-actor claims, so records_exposed uses the confirmed figure and third_parties_affected_count is left null. No monetary loss is stated; the Rs.250 crore figure is the statutory maximum fine under the DPDP Act, not a loss in this incident, and is not converted. Root cause is not stated definitively; the article says the metadata 'strongly points to' outsourced DSA pipeline weaknesses, which is an inference by the author. The CERT-In advisory CIAD-2026-0049 is recorded as a precursor warning, not as a separate incident in this document. Extractor proposed values without quotes; dropped: ['context.coverage', 'context.denominator_available', 'event.agent_involved', 'event.responsible_party', 'event.root_cause', 'event.trigger', 'system.autonomy_level', 'system.deployment_context', 'system.developer']. Extractor quotes not found verbatim in document; dropped: ['event.adversarial_actor']. Single secondary source; corroborate before upgrading any field to B. [2026-11-04: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":"Finance and Insurance","org_size_band":"10000+","country":"IN","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":{"regimes":["DPDP Act","CERT-In","RBI","SEBI LODR"],"notifications":"SBI complied with exchange listing requirements under Sebi (LODR) regulations but issued no direct notices, consumer advisories, or helplines to affected account holders.","litigation_status":"unknown","safety_policy_adherence":null},"coverage":null}}