India's Largest Bank SBI Leaked Account Data On Millions of Customers

An anonymous reader quotes a report from TechCrunch: India's largest bank has secured an unprotected server that allowed anyone to access financial information on millions of its customers, like bank balances and recent transactions. The server, hosted in a regional Mumbai-based data center, stored two months of data from SBI Quick, a text message and call-based system used to request basic information about their bank accounts by customers of the government-owned State Bank of India (SBI), the largest bank in the country and a highly ranked company in the Fortune 500. But the bank had not protected the server with a password, allowing anyone who knew where to look to access the data on millions of customers' information.

The passwordless database allowed us to see all of the text messages going to customers in real time, including their phone numbers, bank balances and recent transactions. The database also contained the customer's partial bank account number. Some would say when a check had been cashed, and many of the bank's sent messages included a link to download SBI's YONO app for internet banking. The bank sent out close to three million text messages on Monday alone. The database also had daily archives of millions of text messages each, going back to December, allowing anyone with access a detailed view into millions of customers' finances. SBI claims more than 500 million customers across the globe with 740 million accounts.

Re: no surprise

[Anonymous Coward]

They did the needful.

And no way to warn them

[Opportunist]

I mean, imagine someone with an Indian accent called you with "Sir, I'm from your bank and we have to inform you ..."

Re:

[Opportunist]

If I posted it in Hindi, who'd get the joke?

Re: And no way to warn them

[dougdonovan]

i cant understand ( them / India )when they do call.

Security reviews

[iTrawl]

When QA tests the functionality, but nobody checks the security. Plenty of times all you have is review the code and ask the question "who is allowed to see this?" to figure out if the answer is "everybody in the world", and decide if that's OK or not.

Not surprised ...

[Anonymous Coward]

Having been at companies who had outsourced development tasks to India, I can't say I'm surprised.

For the first two weeks the people you get seem to know what they're talking about ... then you get the second and third string teams.

We started seeing evidence of multiple people using the same email address, because they were sending contradictory messages from the same email minutes apart, and the quality of the work went downhill and the understanding of what was being asked of them dropped to the point of

Paid a fraction on what Americans get & it sho

[jellomizer]

Over my years of experience, this issue isn't with the skill of the Indians, but the culture of India. You take this person, ship them to America have them work in an American office, and get paid a competitive rate that the others in that office for that job, within a few weeks they are as productive as any other employee.

But the work culture in India, and even with the price parity difference they are getting paid less, and are really expected to do less. So they will do exactly what is told to them, with

Re:

[drinkypoo]

"They didn't bother thinking for the reason of the feature I was asking for, and comprehended I wanted a parameter."

If you know there's a language barrier, and you ask for random when you mean specific, you have only yourself to blame.

Re:

[_merlin]

There's a key cultural difference here - in China and India, you don't question the person giving the orders (the customer when they're paying you, or your boss). I've seen this go badly in various ways. For example two Chinese student pilots in Melbourne were practicing a landing. The pilot forgot to lower the gear, and they walked away unhurt from a belly landing. When asked, the co-pilot said he realised the pilot hadn't lowered the gear, but had said nothing because he dind't want to disrespect his

Re:

[junglee_iitk]

As an Indian working in India my experience has been exactly the opposite. Every single innovative idea has met dismissal from British or American bosses over my career. Twice I have won the internal competitions of creating tools in two different companies (both product companies, not service), both times my immediate manager was given super tight deadlines and when he refused to give me any time to work on those tools, I couldn't blame him. When I was working in a service company, it was basically hammere

thank you come again

[Anonymous Coward]

Well, they are just keeping with the trends really. Catching up to the developed world and its security standards.

SBI does things differently.

[140Mandak262Jamuna]

Pretty soon it will get the government to pass a law to make it illegal to access databases without password. Then it will display a warning saying it is illegal to access this data base. And then wash its hands off saying, "we can't be held responsible for the criminal actions of the miscreants. Affected parties are advised to file complaints against the trespassers with the appropriate authorities who would do the needful". Then they will go return to status quo ante.