Second uranium fuel shipment for Rooppur Unit 2 reaches the plant

State Bank of India said on Wednesday that an incident involving the loss of certain data had exposed the personal information of 3,897 customers on the dark web, a disclosure that puts India's largest lender at the centre of growing concern over cyber security in the country's financial sector.

In a filing to Indian stock exchanges, the bank said a preliminary review of about 375,000 records found on the dark web had identified 3,897 customer records containing personally identifiable information.

The records included customers' names, gender, registered mobile numbers, dates of birth, email addresses and residential addresses. They also carried branch and Customer Information File identifiers, lead IDs, and metadata linked to loan and lead records and other related files.

SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, or CERT-In, about the suspected exposure. The bank said it activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency approved by CERT-In to carry out a full assessment.

The lender said the incident had no material impact on its core business operations, financial performance or business continuity, and that its core functions were operating normally. It said a detailed assessment was under way and that remedial and preventive measures were being implemented as required.

The filing leaves several important questions open. SBI said the investigation must establish the authenticity and completeness of the exposed data, identify its possible source, and determine how far the exposure went and what risk it poses to customers and to the bank. It did not say whether the affected customers had been contacted, and it did not name any person or group behind the leak.

The bank also did not say whether copies of identity documents, such as passports or national identification papers, were among the records. Until those points are answered, the full significance of the incident remains uncertain.

The difference between the two figures in the filing matters. SBI reviewed about 375,000 records on the dark web but identified 3,897 containing personal information, which suggests that much of the material circulating may be duplicated, unrelated or not genuine. The bank itself says the authenticity of the data is still being verified, so the final number of affected customers could change.

SBI is India's largest commercial bank and is majority-owned by the government. It has a very large retail customer base and operations in several countries, which means a data exposure at the lender can reach well beyond India's borders.

The disclosure comes as India's banking regulator has been pressing lenders to strengthen their cyber defences in recent years, amid a rise in threats targeting financial institutions. Banks hold some of the most sensitive personal information collected in any industry, including identity records, income details and loan histories.

For customers, the immediate risk is not that someone can withdraw money with a name and address alone. The greater danger is targeted fraud: a caller who already knows a person's date of birth, home address and loan details can sound like a genuine bank officer and use that familiarity to ask for a one-time password, PIN or card number. Customers should treat unexpected calls about accounts, loans or identity checks with suspicion and contact their bank through numbers they have verified independently.

The case also matters to families in Bangladesh who hold accounts, study or work in India, or send and receive money across the border. Personal data leaked in one country can be used in another, and the tactics of impersonation fraud do not stop at frontiers.

What happens next will depend on the investigation. SBI has promised to publish the outcome of its assessment only in general terms so far, and it is not yet known whether regulators will require direct notification of affected customers, whether the remaining records on the dark web will be confirmed as genuine, or whether the source of the leak will be traced to the bank's own systems, a vendor or another party. For now, the confirmed facts are narrow: 3,897 records were identified, they contained personal and loan-related information, and an outside agency is examining how they got out.

Fifty-six candidates who were recommended for the 45th Bangladesh Civil Service but left out of this month's appointment gazette are continuing a sit-in at Dhaka University and say they will begin an indefinite hunger strike if the government does not explain why they were dropped.

The Public Service Commission recommended 1,807 candidates in November last year. The Ministry of Public Administration's gazette, published on 14 October, appointed 1,702 of them and told the new officers to report to their ministries or divisions by 1 November. It did not say why the remaining 105 were left out.

Candidates who stay in touch with one another say 49 of the 105 did not complete medical examinations or other procedures. That leaves 56 who say they have never been given a reason for their exclusion. Nine of the 56 are from the Hindu community, according to the group; Prothom Alo listed their names and cadres.

The group met State Minister for Public Administration Md Abdul Bari on Saturday and handed him a memorandum asking for a review. He advised them to file individual applications, which they submitted to the ministry's senior secretary the following day. Since Monday they have been sitting in front of the Raju Memorial Sculpture from noon until 6:00pm. Md Mehedi Hasan, one of the candidates, said the sit-in would continue and that an indefinite hunger strike would start on Wednesday if there was no decision.

Several of the excluded candidates are not first-time applicants. Shubhra Debnath, recommended for the health cadre, was also left out of the 48th special BCS gazette in January and has since been recommended for the police cadre in the 46th BCS. "I have no idea who is acting against me or why," he told Prothom Alo. "However, the government could not exclude me on the grounds of merit. What is happening is deliberate."

Partha Sarkar, a veterinary graduate of Bangladesh Agricultural University who was recommended for the livestock cadre, turned down a scholarship in Australia in 2024 while waiting for the appointment. "I have never felt this bad in my life," he said. Chinmoy Barman, recommended for the police cadre, said he placed 76th on merit and that his father is a fisherman. HM Ferdous Khan, recommended for the education cadre, said he could not face relatives who now look at him with suspicion.

The gazette gave no reasons, and the candidates' accounts differ on why they believe they were removed. Several told The Daily Star they had no criminal cases and suspected their past political links were the reason. Two said they had been members of the now-banned Chhatra League. Fazle Iffat Anik said he joined the organisation to secure dormitory accommodation, while Sazzad Hossain said he had taken part in the July 2024 uprising after setting his political identity aside.

Others say they have no political background at all. Sri Krishna Chaitanya Nandi of Sylhet Agricultural University said he could not even guess why he was excluded. Nur-e Alam Miazi, a Rajshahi University student, said he had been told a government agency reported him as an active Chhatra League member; he already works as an assistant director in the Ansar cadre after joining through the 44th BCS. Iftekharul Islam, recommended for the administration cadre, is already an assistant surgeon through the 48th special BCS.

The exclusions sit awkwardly with assurances given by the government. Home Minister Salahuddin Ahmed said on 1 October that nobody would be excluded on the basis of political identity, after protests over 46 candidates left out of the 49th special BCS. Most of those candidates were later included. Prothom Alo reported that 668 people were provisionally nominated for the education cadre in that batch and 611 were appointed.

Public Administration Secretary Quamruzzaman Chowdhury told The Daily Star that the gazette had been issued following established procedures. "No one was excluded," he said, adding that the government had followed the meritocracy declared by the prime minister and that this time was no exception. Asked whether another gazette would be issued, he said he could not say for certain and that the process was still running.

What remains unexplained is the substance of the verification that removed the 56. The government has not published the findings, and it has not said whether the candidates will be told what was held against them or given a chance to respond. It is also unclear whether a supplementary gazette is being prepared, how many of the 56 could be reinstated, and what the government will say about the nine Hindu candidates in the group.

For now the practical effect is a stalled career for people who passed every stage of the examination. The 1,702 appointees are due to join by 1 November. The 56 say they will stay at the Raju sculpture until they receive an answer, with the hunger strike planned from Wednesday.