57
State Bank of India (SBI) has established a Cybersecurity Centre of Excellence called CyRIS to strengthen its digital security capabilities following alerts about the suspected exposure of customer data on the dark web.
The centre was inaugurated on October 26 by Sanjay Lohiya, Secretary of the Department of Financial Services, according to reports published on October 26 and 27.
The development follows an incident in which SBI received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the possible exposure of customer information.
According to the bank’s preliminary analysis, approximately 375,000 records found on the dark web were examined, of which 3,897 customer records contained personally identifiable information. SBI has initiated an investigation to determine the nature and extent of the suspected exposure.
CyRIS will focus on several areas of cybersecurity, including threat intelligence, digital forensics, malware analysis, ethical hacking, fraud analytics and artificial intelligence security. The centre will also explore quantum-safe technologies to strengthen protection against emerging cyber threats.
The initiative is built around three pillars: THINK, INNOVATE and DEFEND. These focus on cybersecurity policy and awareness, research and innovation, and improving threat detection and incident response.
SBI is also working to strengthen cybersecurity awareness among its employees. The bank reported that approximately 181,000 employees completed cybersecurity e-learning during the 2025–26 financial year.
The establishment of CyRIS highlights the growing importance of cybersecurity in India's banking sector, where digital transactions and online services have increased the need to protect sensitive customer information.
However, the effectiveness of the new centre will depend on how its capabilities are implemented and how effectively they help the bank detect, investigate and respond to cyber threats.
SBI has said the suspected data exposure has not had a material impact on its core business operations or financial performance, and its banking services continue to operate normally.
The centre was inaugurated on October 26 by Sanjay Lohiya, Secretary of the Department of Financial Services, according to reports published on October 26 and 27.
The development follows an incident in which SBI received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the possible exposure of customer information.
According to the bank’s preliminary analysis, approximately 375,000 records found on the dark web were examined, of which 3,897 customer records contained personally identifiable information. SBI has initiated an investigation to determine the nature and extent of the suspected exposure.
CyRIS will focus on several areas of cybersecurity, including threat intelligence, digital forensics, malware analysis, ethical hacking, fraud analytics and artificial intelligence security. The centre will also explore quantum-safe technologies to strengthen protection against emerging cyber threats.
The initiative is built around three pillars: THINK, INNOVATE and DEFEND. These focus on cybersecurity policy and awareness, research and innovation, and improving threat detection and incident response.
SBI is also working to strengthen cybersecurity awareness among its employees. The bank reported that approximately 181,000 employees completed cybersecurity e-learning during the 2025–26 financial year.
The establishment of CyRIS highlights the growing importance of cybersecurity in India's banking sector, where digital transactions and online services have increased the need to protect sensitive customer information.
However, the effectiveness of the new centre will depend on how its capabilities are implemented and how effectively they help the bank detect, investigate and respond to cyber threats.
SBI has said the suspected data exposure has not had a material impact on its core business operations or financial performance, and its banking services continue to operate normally.
