State Bank of India (SBI) has confirmed it has individually contacted customers whose records were identified during a recent cyber incident. The bank’s announcement follows earlier criticism regarding its communication strategy, as it had initially intimated the incident to stock exchanges but not directly to affected customers, drawing public scrutiny. A preliminary review of the suspected cyber incident flagged 3,897 customer records, prompting the bank to undertake direct communication.

The public sector lender has sought to reassure its customers, explicitly stating that account balances and funds held with the bank remain secure and unaffected by the incident. SBI further clarified that an ongoing investigation is actively examining the authenticity and full extent of the data potentially exposed. This proactive communication aims to address concerns previously raised about the bank's transparency regarding the breach and to provide clarity to those potentially impacted by the flagged records.

The incident has reignited discussions around data breach notification protocols for financial institutions in India, highlighting a perceived gap in current regulatory frameworks. The Internet Freedom Foundation (IFF), a prominent digital rights organisation, has called upon the Reserve Bank of India (RBI) to issue a directive mandating all regulated entities to notify customers of personal data breaches within a specified timeframe. This proposed regulatory action is intended to ensure timely disclosure and consumer protection, especially pending the formal commencement of the upcoming Digital Personal Data Protection (DPDP) Act. The IFF's recommendation underscores the critical need for clear, consistent, and timely disclosure mechanisms to safeguard consumer interests and maintain public trust in the digital financial ecosystem.

The bank's decision to directly inform affected individuals marks a significant adjustment in its approach to managing the fallout from the cyber incident. While the initial notification to stock exchanges fulfilled certain corporate regulatory obligations, the subsequent direct communication with customers reflects an effort to mitigate widespread concerns and provide specific information to those whose records were potentially involved. The findings from the ongoing investigation will be crucial in determining the precise nature of the exposure and will likely inform future security enhancements and communication strategies.

This event underscores the broader challenges faced by large financial institutions in safeguarding sensitive customer data against the backdrop of increasingly sophisticated cyber threats. The call for a clear, sector-wide RBI directive on data breach notifications suggests a recognised need for a standardised framework that ensures robust consumer protection across the financial sector, irrespective of the ongoing legislative developments. As the investigation continues, the primary focus remains on ensuring the integrity and security of customer data, alongside fostering greater transparency and accountability in handling such incidents to uphold public confidence in India's banking system.