SBI confirms customer data exposed on dark web
The State Bank of India disclosed to the stock exchange that customer data has appeared on the dark web. A preliminary review attributed 3,897 records with PII to SBI, out of roughly 375,000 records found. The bank activated incident response with a CERT-In empanelled agency, says balances are safe and affected customers were individually notified.
What happened
State Bank of India, India's largest commercial bank, told stock exchanges on October 21, 2026 that customer data appeared on the dark web. Preliminary analysis confirmed 3,897 records with personally identifiable information out of about 375,000 records found. On October 23, the bank said it had individually notified all affected customers by email and/or WhatsApp.
Why it matters
Exposed data includes names, mobile numbers, dates of birth, email addresses, home addresses, and branch, CIF and loan record identifiers, enabling phone scams using real customer details. The bank says there is no material impact on operations, financial performance or business continuity, and that balances are safe. The Internet Freedom Foundation warns customers may get calls from fake SBI officials who can recite their account details.
What to do
Strengthen fraud and social engineering monitoring around affected customers and repeat the warning to never share OTP, PIN or password. Track the findings of the CERT-In-empanelled agency investigating the source and full extent of the leak, including what the remaining records contain.
For the technical team
- Affected
- Registros de clientes do State Bank of India · State Bank of India customers: 3,897 records with personally identifiable information identified in preliminary analysis, out of roughly 375,000 records available on the dark web. Exposed data: names, gender, registered mobile numbers, dates of birth, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and related files.
- Exploitation
- Data already published on the dark web. The Internet Freedom Foundation reports that a threat monitoring account on X flagged a claim by a group calling itself "Siriusim" that it released 3.75 lakh rows of SBI data and 2,722 PDF documents, including loan applications and account opening forms; the bank's disclosure does not mention these documents.
- Fix
- No software fix. The bank activated cyber incident response and containment protocols, engaged an independent CERT-In-empanelled cybersecurity agency for a comprehensive assessment, and says remedial and preventive measures are being implemented as required.
- Vector
- Customer data leak with undisclosed source and technical vector. The bank says a detailed investigation is required to establish the authenticity, source and extent of the exposure.
- More details
- Alerts arrived on October 16, 2026 from the bank's threat intelligence service provider, the Defence Cyber Agency, and CERT-In; the stock exchange disclosure came on October 21, 2026. The IFF notes the bank did not detect the breach itself and that the legal duty to notify each customer (Section 8(6) of the DPDP Act 2023, Rule 7 of the DPDP Rules 2025) only takes effect on May 13, 2027. On October 23, 2026, the bank said it had individually informed all affected customers by email and/or WhatsApp.
Timeline
SEBI disclosure confirms customer records exposed on the dark web.
Sources 4 sources
- Disclosure under Regulation 30 of SEBI (LODR): Incident involving Data Loss (PDF) State Bank of India via NSE
- Data breach: SBI admits exposure of its customer data on the Dark Web The Hindu
- Data breach: SBI says it individually informed all affected customers The Hindu
- Data leak incident: SBI says customer balances completely safe The Hindu BusinessLine
- SBI cyber attack update: State Bank of India says customer balance are completely safe despite data leak The Economic Times
