The Original October Alert
The story began on October 16, 2026, when the State Bank of India (SBI) received alerts from multiple cybersecurity bodies, including the Indian Computer Emergency Response Team (CERT-In) and the Defence Cyber Agency. The warnings pointed to a potential
exposure of customer data found on the dark web. A hacker group known as 'Siriusim' had allegedly posted a large dataset of around 375,000 records and thousands of PDF files, claiming they belonged to SBI customers. In response, SBI publicly disclosed the potential incident on October 21 and launched a formal investigation.
What the New Review Uncovered
The headline figure of 3,897 records stems from the bank's preliminary analysis of that much larger 375,000-record dataset found online. While investigating the larger pool of data, SBI's cybersecurity partners confirmed that nearly 4,000 of those records contained personally identifiable information (PII) linked to its customers. It’s crucial to understand that the initial review doesn't confirm all 375,000 records belong to SBI customers; rather, it has so far positively identified a fraction of them as containing genuine personal details. The investigation is still ongoing to determine the authenticity and scope of the entire dataset.
What 'Personal Details' Were Exposed?
The kind of information found is cause for concern. According to SBI's regulatory filings, the exposed PII includes customer names, registered mobile numbers, dates of birth, email addresses, and residential addresses. Furthermore, the records contained internal banking identifiers such as branch details, Customer Information File (CIF) numbers, and metadata related to loan applications. This combination of personal and banking-related information creates significant risk, as it could be used by fraudsters for targeted phishing attacks, impersonation, and identity theft. The bank has stated that core credentials like passwords, PINs, or account numbers were not part of this specific exposure.
SBI's Response and Next Steps
SBI has maintained that the incident has no material impact on its core business operations or financial stability, assuring customers that its systems remain secure. Upon receiving the initial alerts, the bank activated its cyber incident response protocols and engaged an independent cybersecurity agency, empanelled by CERT-In, to conduct a comprehensive assessment. In a press conference in early November, SBI Chairman C S Setty confirmed the root cause analysis is still underway and emphasized that containment measures and identifying system vulnerabilities were the immediate focus. He stated that the incident has reinforced the bank's resolve to strengthen its cybersecurity framework and that it is collaborating with the wider banking industry to tackle emerging threats.
What This Means For Customers
For the nearly 3,900 individuals whose data has been confirmed in the leak, the primary risk is not a direct loss of funds but sophisticated fraud attempts. Scammers armed with detailed personal and loan-related information can craft highly convincing fake calls or messages appearing to be from the bank. All SBI customers should remain vigilant against unsolicited communications asking for personal details or financial information. It is critical to never share passwords, OTPs, or card details. If you suspect any fraudulent activity, you should contact the bank immediately through official channels. Digital rights organizations have also called on SBI to directly notify all affected customers without delay.
