SBI’s cyber wake-up call after data breach: Fight AI with AI

Cybersecurity remains a priority, and there will be no compromise on spending to strengthen it, State Bank of India chairman C. S. Setty said on Tuesday. The country’s largest lender is working with other players to create a testing environment for new and frontier artificial intelligence models to identify and fix system vulnerabilities and prepare for cyber fraud and emerging AI risks.

“Most of us don't use the frontier tools for fighting the AI. So, we need to probably focus on how do we handle this emerging AI risk, not only at the bank level, at the industry level. And we are working with other players in terms of creating a sandbox environment for testing these AI tools. Obviously, you can't deploy them in the production environment. You have to test them separately and then see how quickly you identify the vulnerabilities and what is the patchwork to be done,” Setty said.

His remarks come days after a cyberattack on the lender exposed the personally identifiable information of 3,897 customers on the dark web.

According to SBI, the exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files.

Setty said on Tuesday that a root cause analysis of the incident was still underway and would take time.

“Our focus was in terms of containment measures and also identify the vulnerabilities which led to this breach and remediate them. We also have undertaken complete cybersecurity drill in terms of API sweep and vulnerability assessments,” he said.

He stressed that the security of its systems and customer information is paramount for the bank. SBI is strengthening its cybersecurity measures to prevent similar breaches in the future.

“We need to put in the AI tools. What we call fighting AI with the AI tools,” he said.

Setty noted that increasing digitalisation is expanding the attack surface. Government bodies and private and public sector entities are working collectively to ensure that such incidents do not undermine trust in the digital system.

Setty also called for better information sharing among financial institutions after such incidents.

“While it is definitely shared with the regulators and the security agencies, the moment the incident happens, among the banks if it can be informed through a structured mechanism, that would be quite useful so that people can immediately take the measures. This is something what we are seriously working under the IBA (Indian Banks Association),” he said.

SBI on Tuesday reported a 14% rise in net profit to Rs 23,038 crore for the July-September quarter. Net interest income rose around 15% to Rs 49,143 crore.

The bank’s loans grew 18% in July-September, while deposits rose more than 12%. Deposit growth was boosted by strong inflows through foreign currency non-resident (FCNR (B)) deposits during the concessional swap window opened by the Reserve Bank to support a falling rupee.

SBI retained its credit and deposit growth guidance for the full year ending March 2027. It expects loan growth of 14-15% and deposit growth of 10-11%.

“On the credit growth side, our focus is in how do we relate it to the nominal GDP growth. If nominal GDP growth is around 12-12.5%, normally the SBI growth rate is 3-4% over that and that is where the guidance of 14-15% is coming from,” noted Setty.

SBI shares closed 1.8% lower at Rs 969.55 on the BSE, even as the broader Sensex surged 1.6%.