SBI data breach: What happened, who is at risk?

• SBI reports a suspected data breach on the dark web
• 3,897 customer records including names and mobile numbers leaked
• Bank investigates source while banking services remain normal

New Delhi: State Bank of India (SBI) has reported a suspected customer data breach after nearly 3.75 lakh records surfaced on the dark web. In a regulatory filing to the stock exchanges on Wednesday, the country’s largest public sector lender confirmed that an initial examination identified 3,897 customer records containing personal information, including names, mobile numbers, dates of birth and residential addresses. The bank is now investigating how the information reached the dark web and whether more customers could be affected.

The incident came to SBI’s attention on October 16, when its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency

Response Team (CERT-In) alerted the bank about the suspected exposure. The filing states that a detailed investigation is underway to verify the leaked information and identify its source. For customers, the immediate concern is the possible misuse of their personal details by cybercriminals.

Regulatory filing by SBI: 21 October 2026

Read more: AI agents break into Indian companies’ live systems, CERT-In issues ‘critical’ alert

What SBI revealed about the data leak

According to the bank’s disclosure [pdf] under Regulation 30 of SEBI’s listing regulations, investigators examined approximately 3,75,000 records available on the dark web. Of these, 3,897 records were initially identified as containing personally identifiable information.

The exposed data reportedly includes several details that customers share with banks when opening accounts, applying for loans or registering for financial services.

Information	Details reportedly exposed
Personal details	Names, gender, dates of birth
Contact information	Mobile numbers, email IDs, residential addresses
Banking identifiers	Branch details, CIF identifiers
Loan information	Lead IDs and loan-related metadata

SBI has not established whether all 3.75 lakh records are genuine customer records or whether they represent unique individuals.

Read more: Online ads infected Al Jazeera devices with zero-click spyware, report says

SBI launches investigation, says banking operations remain normal

Following the alert, SBI activated its cybersecurity incident response procedures and engaged an independent CERT-In-empanelled agency to investigate the suspected compromise.

The bank said the incident does not have any “material impact” on its core business operations, financial performance or business continuity.

SBI maintained that its banking services continue without disruption. Investigators are examining the authenticity of the exposed records, the possible source of the information and the risks facing customers.

The filing does not confirm whether hackers accessed SBI’s core banking systems or whether account passwords, PINs and transaction credentials were compromised.

Read more: 40% of Indian SMEs hit by cyber incidents, but only 12% monitor threats continuously: Study

What does the SBI data leak mean for customers?

The biggest immediate concern is the possibility of phishing and identity fraud. A criminal who knows someone’s name, registered mobile number and loan-related details could use that information to make a fraudulent call or message appear genuine.

For instance, a scammer could impersonate an SBI employee, refer to a customer’s loan application and demand an OTP to complete a fake verification process.

Customers should avoid sharing OTPs, passwords and banking PINs. They should verify unexpected calls through SBI’s official channels and monitor their accounts for suspicious activity.

The exact scale of the incident remains unclear. SBI’s investigation will determine how the data was exposed, whether additional records are affected and what further protective measures are required.