IBA working on cyber incidents information sharing: CS Setty

The countrys largest lender State Bank of India SBI Chairman CS Setty on Tuesday said cybersecurity risks is a serious concern and the banking sectors industry body Indian Banks Association IBA is working to create a platform to share information on cyberattacks among the entities in the financial sector according to news agency PTISetty who is also the Chairman of the IBA said the industry body is also working on ways to counter frontier artificial intelligence AI modelsled attacks on the systemsUnder the aegis of IBA we are working for a platform for information sharing among entities which will help everybody to take adequate measures in response to a particular attack Setty saidHe noted that banks currently share information on cyberattacks with regulators and government agencies responsible for law enforcement however there is no system for sharing information with other banksHigher digitalisation has led to increased cybersecurity risksSetty also heads a governmentappointed panel tasked with ways of tackling risks from sophisticated frontier models like Anthropics MythosHe pointed out that the cybersecurity risks have increased with higher digitalisation in the economyRecently many banks including SBI ICICI Bank and others have reported cybersecurity related attacksWhile stating that Indian banks do not use frontier AI models Setty said it is essential for the system to understand the risks emanating from these models as cybercriminals could use themHe said IBA is planning to create a sandbox in which all systems can be tested for vulnerabilities and if required new patches can be suggested as part of the efforts to use AI to counter AI threatsOn the investment in enhancing the cybersecurity he did not divulge the details and said money is not a constraint when handling something as critical as cybersecuritySBI data breachRecently SBI reported a data breach where personally identifiable information PII of 3897 customers were found on the dark web and Setty said efforts were underway to do a root cause analysis of the breach which will take some timeOur focus was on containment measures and also identifying the vulnerabilities which led to this breach and remediating them We also undertook a complete cybersecurity drill Setty saidSBI customer data found on dark webSBI on October 21 had confirmed that 3897 customer records were exposed on the dark web with information related to customers registered mobile numbers dates of birth names gender email addresses residential addresses branch and CIF identifiers lead IDs and metadata associated with loanlead records and other related filesThe lender had said that during the preliminary analysis of approximately 375000 records available on the dark web 3897 customer records containing Personally Identifiable Information PII were identifiedBank had said only a small number of customers were impactedIn a message posted on its official X account SBI told customers the incident had impacted ldquoa very very small number of customersrdquo and assured them that balances were ldquocompletely saferdquo The bank said the episode did not affect its IT systems core business operations financial performance or business continuity and that protecting customer data and trust remained its highest priorityInvestigation into the incidentThe lender in a regulatory filing had said that an independent CERTInempanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromiseSBI had said it does not expect any material impact on bankrsquos core business operations financial performance or business continuity due to the data breachThe Banks core business functions continue to operate normally without disruptions A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required We reassure that the Bank continues to monitor the situation closely and take all appropriate measures in accordance with applicable regulatory requirements it had saidWith inputs from PTI