MUMBAI: State Bank of India has informed its insurer about a suspected data breach and is assessing the extent of the incident and potential losses before filing a claim, according to a person familiar with the matter. The country’s largest lender may seek a payout under its cyber insurance policy, with the amount dependent on the losses covered under the policy.SBI may seek a claim under a Rs 1,425-crore cyber insurance policy with Oriental Insurance following a suspected leak of customer data, people familiar with the matter told ET. “SBI is in the process of notifying the insurer about the claim,” said a person aware of the development.
Both SBI and state-run Oriental Insurance did not respond to requests for comment.
The country’s largest mass lender is investigating a data security incident after a threat actor group reportedly leaked around 375,000 rows of data and 2,722 PDF documents on the dark web.
Any insurance claim would depend on the policy’s terms and conditions, the nature of the incident and the losses, if any, found to be covered. The Rs 1,425-crore limit is the coverage ceiling.
Also Read: SBI probes suspected data breach after 3.75 lakh records surface on dark web
“A well-drafted cyber insurance policy may also cover certain liabilities and expenses arising from data protection law violations, depending on its wording and applicable law,” said an insurance broker. “However, coverage for regulatory fines can be subject to restrictions and exclusions, making policy terms important.”
SBI said it examined the records available on the dark web and identified 3,897 customer records containing personally identifiable information. The exposed information reportedly includes names, mobile numbers, dates of birth, email addresses, residential addresses and details linked to loan applications.
The bank has activated its cyber incident response procedures and appointed an independent cybersecurity agency empanelled by the CERT-In to investigate the incident.
