State Bank of India (SBI) is taking new steps to address a potential data leak. Following a disclosure in October, the bank has now engaged independent cybersecurity experts to investigate the incident and assess the potential impact on customers.
The October Disclosure
The
investigation follows an official disclosure from SBI on October 21, 2026. The bank confirmed it had been alerted on October 16 by its threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) about a suspected exposure of customer data on the dark web. A preliminary analysis of around 375,000 records found online revealed that 3,897 contained personally identifiable information of customers. A hacker group named 'Siriusim' had reportedly claimed responsibility on a dark web forum, though SBI has not officially named any group.
What Data Is at Risk?
The information identified in the initial analysis is sensitive. According to the bank's own filing, the exposed details include names, registered mobile numbers, dates of birth, email addresses, and residential addresses. It also contained banking metadata such as branch details, Customer Information File (CIF) identifiers, and information related to loan records. While the bank has stated that core banking systems, account balances, and funds remain safe, the leaked personal data creates significant risk. Criminals can use such information to orchestrate sophisticated phishing attacks, impersonation scams, and other forms of fraud.
Why Bring in Independent Experts?
By engaging a CERT-In-empanelled cybersecurity agency, SBI is following a standard and necessary protocol for incidents of this nature. Independent experts bring several key advantages. Firstly, they provide an unbiased, third-party assessment of the breach, which adds credibility to the investigation. Their specialized skills are crucial for conducting a deep forensic analysis to determine the source of the leak, understand the full extent of the exposure, and identify any vulnerabilities in the bank's systems or those of its partners. This external validation is vital for regulatory compliance and for rebuilding customer trust.
What SBI Has Said
SBI has been proactive in its communication since the disclosure. The bank has stated that it immediately activated its incident response and containment protocols upon receiving the alerts. It has assured customers that the incident has had 'no material impact' on its core business operations or financial performance. In a follow_up statement, the bank confirmed it had individually informed all customers whose data was identified as being involved in the breach. SBI Chairman C S Setty stated that the incident has 'strengthened our resolve' to enhance cybersecurity measures across the bank and the broader financial ecosystem.
What Customers Should Do Now
Even with the bank's assurances, customers must remain vigilant. The primary risk from this type of data exposure is targeted fraud. Be extremely suspicious of any unexpected calls, SMS messages, or emails claiming to be from SBI, especially if they ask for personal information or create a sense of urgency. Never share your PIN, OTP, or passwords. It is crucial to remember that banks will never ask for these details. Enable transaction alerts on your account and monitor your statements regularly for any unauthorized activity. If you spot anything suspicious, report it to the bank immediately through official channels and file a complaint on the National Cybercrime Reporting Portal or by calling the helpline number 1930.
