State Bank of India (SBI) is investigating a serious data security incident after thousands of customer records surfaced on the dark web. For the bank's millions of customers, this news raises urgent questions about personal and financial safety.
What We Know Happened
On October
16, 2026, the State Bank of India received multiple alerts about a potential customer data exposure. These warnings came from its own threat intelligence provider, the Indian Computer Emergency Response Team (CERT-In), and the Defence Cyber Agency. Following these alerts, a cybersecurity monitoring account claimed a threat actor named 'Siriusim' was offering a large dataset allegedly linked to SBI. In a regulatory filing on October 21, SBI confirmed it was investigating the matter. The bank's preliminary analysis of around 375,000 records found online identified 3,897 records containing customers' personally identifiable information (PII). SBI has since engaged an independent cybersecurity agency to conduct a full forensic assessment to determine the source, authenticity, and full extent of the leak.
What Customer Data Was Exposed?
According to SBI's own disclosure, the compromised information is significant. The 3,897 confirmed records include sensitive personal details such as customer names, registered mobile numbers, dates of birth, gender, email addresses, and residential addresses. Additionally, the data contained banking-specific identifiers like branch codes and Customer Information File (CIF) numbers. Information related to loans, such as lead IDs and associated metadata, was also part of the exposed records. While the investigation is ongoing, SBI has stated that the incident has not had a material impact on its core banking operations or financial stability, and that services are running normally. On October 23, the bank stated that it had started notifying the affected customers individually via email and WhatsApp.
The Risks: Why This Matters for You
Even though account passwords and financial credentials were not reported as part of the leak, the exposed personal information is a goldmine for fraudsters. Scammers can use these details to craft highly convincing phishing attacks. They might call or message you, quoting your full name, date of birth, or address to appear legitimate before asking for an OTP, PIN, or password to 'verify' your account. This is a common tactic used to gain unauthorized access to accounts and commit financial fraud. The presence of loan-related data also creates a risk of loan-related scams, where fraudsters might contact individuals with fake loan approval offers that require an upfront 'processing fee'.
How to Protect Your Account Right Now
Vigilance is your best defence. First and foremost, never share your OTP, PIN, CVV, or passwords with anyone, no matter how convincing they sound. Genuine bank employees will never ask for this information. Be extremely suspicious of any unsolicited calls, SMS messages, or emails claiming to be from SBI, especially if they create a sense of urgency about blocked accounts, KYC updates, or rewards. It is crucial to monitor your bank statements and credit reports regularly for any transactions or loan applications you do not recognize. Enable transaction alerts via SMS and email for immediate notification of any activity in your account. If you need to contact the bank, use only the official phone numbers and websites listed on your bank card or passbook. If you receive a suspicious communication, report it immediately to SBI at report.phishing@sbi.co.in and to the National Cyber Crime Helpline at 1930.
