Reports of thousands of State Bank of India customer records appearing on the dark web have sparked concern. SBI has launched an investigation, assuring customers that core banking operations and funds remain secure. Here is what we know so far.
The Alarming Discovery on the Dark Web
On October
16, 2026, the State Bank of India received alerts from multiple sources, including the Indian Computer Emergency Response Team (CERT-In), about a potential data leak. A large dataset of approximately 375,000 records was found circulating on the dark web, a hidden part of the internet often used for illegal activities. Following this, a threat actor claimed responsibility for leaking the data, which reportedly included CSV files and thousands of PDF documents. SBI immediately launched an investigation to verify the claims and assess the impact on its customers.
What Information Was Exposed?
After a preliminary analysis, SBI confirmed it had identified 3,897 records containing customers' Personally Identifiable Information (PII). The exposed information reportedly includes names, residential addresses, dates of birth, mobile numbers, and email addresses. Crucially, internal banking identifiers like Customer Information File (CIF) numbers and details related to loan applications were also part of the leak. However, the bank has clarified that sensitive financial data such as account passwords, PINs, card numbers, or CVVs were not compromised. The origin of the leak is still under investigation, with possibilities ranging from a direct breach to a compromise at a third-party vendor.
Is Your Money Safe? SBI's Official Response
This is the primary concern for any banking customer, and SBI has been firm in its response. The bank has repeatedly stated that the incident has had no material impact on its core banking systems. In a statement, SBI assured customers that their account balances and funds are safe. The investigation is being conducted by an independent cybersecurity firm empanelled by CERT-In to ensure a thorough and unbiased assessment. While the bank has confirmed that banking operations are continuing normally, the exposure of personal data creates other risks that customers must be aware of.
The Real Risk: Phishing and Identity Fraud
Even though your money has not been directly stolen, the leaked data is a goldmine for fraudsters. Criminals can use your name, phone number, and address to craft highly convincing phishing scams. They might call or send messages pretending to be from SBI, using your personal details to gain your trust before asking for an OTP, PIN, or password. Remember, a legitimate bank will never ask for this information. The goal of these scammers is to trick you into giving them the final keys they need to access your account. The leaked information makes their attempts at social engineering far more believable and dangerous.
What SBI Customers Should Do Immediately
Vigilance is your best defense. First, monitor your bank accounts and transaction history closely for any activity you don't recognise, no matter how small. Be extremely suspicious of unsolicited calls, SMS, or emails claiming to be from SBI. Do not click on any links or download attachments from such messages. If you need to access your account, always type the official bank URL (sbi.co.in) directly into your browser or use the official mobile app. SBI has stated that it began notifying the 3,897 affected customers individually via email and WhatsApp on October 23. If you receive any suspicious communication, report it. You can call the national cybercrime helpline at 1930 or file a complaint at cybercrime.gov.in.
