Mumbai: State Bank of India is assessing the impact of a breach of customer information and has alerted its cyber insurance provider, the bank said, adding that the exact data exposed is still being examined.
Against this backdrop, the Reserve Bank of India has issued an important direction to banks and payment companies. Where personal customer data has been breached, the entities concerned must forensically clear their technology environments and confirm they are safe, the RBI said.
The Internet Freedom Foundation said that, pending the full rollout of the data protection law, the RBI should require all regulated entities to notify customers of a personal data breach within a fixed period. It also urged that breach information not be withheld.
With cyberattacks rising across digital services, the issue has gained importance. Experts said the episode tests both data security in banking and the system for informing customers in time. They advised customers to change passwords and not respond to suspicious messages.
The bank sought to reassure customers, saying the situation is being monitored and necessary steps are being taken. The full extent of the breach will become clear only after the final investigation report.
The concern over data safety has grown after a separate warning that weak cryptographic keys issued by a digital security firm could have exposed secure web traffic, including on some banking and payment websites. Regulators have been pushing entities to tighten their cyber defences and to be quicker in telling customers when their information is at risk. Banks are also being asked to review third-party vendors whose systems touch customer data.