India's largest lender, the State Bank of India (SBI), is currently investigating a suspected data exposure after customer records were found on the dark web. For millions of customers, this raises urgent questions about data safety and fraud.
What We Know So Far
On October
16, 2026, SBI received alerts from its threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) about a potential customer data exposure. In a subsequent stock exchange filing, the bank confirmed it was investigating the matter. A preliminary analysis of approximately 375,000 records found on the dark web identified 3,897 records containing customers' personally identifiable information (PII). The bank has emphasized that its core business operations and financial performance have not been materially impacted by the incident. An independent cybersecurity agency has been appointed to conduct a full investigation to establish the authenticity of the data, the source of the leak, and the full extent of the exposure.
What Information Was Exposed?
According to SBI's own disclosure, the exposed information includes a range of personal and financial details. This reportedly includes customer names, registered mobile numbers, dates of birth, email addresses, and residential addresses. Additionally, the records contained bank-specific identifiers like branch details, Customer Information File (CIF) numbers, and metadata related to loan applications. The primary danger of this type of exposure is not necessarily direct theft from accounts, but the use of this information for sophisticated scams. Scammers can use these details to sound more credible when impersonating bank officials, making it easier to trick customers into revealing confidential information like passwords or OTPs.
How SBI is Responding
SBI has activated its cyber incident response and containment protocols. In a press conference, SBI Chairman C.S. Setty stated that the incident has 'strengthened our resolve' to enhance cybersecurity measures. He confirmed that a root cause analysis is underway, though it will take time. The bank's immediate focus has been on containment measures, identifying vulnerabilities, and remediation. Setty also mentioned that SBI is conducting a comprehensive cybersecurity drill, including sweeps of its Application Programming Interfaces (APIs), to identify and fix potential weaknesses. Furthermore, the bank is working with the Indian Banks' Association (IBA) to create a structured mechanism for sharing threat information across the entire banking sector to bolster collective security.
What Customers Should Do Now
While the bank's investigation is ongoing, customers are advised to take proactive steps to secure their accounts. The most critical advice is to be extremely vigilant against phishing attempts. Be suspicious of any unexpected calls, SMS messages, or emails claiming to be from SBI, even if the sender knows some of your personal details. Never share your OTP, card PIN, or internet banking password with anyone. Bank representatives will never ask for this information. It is also highly recommended to enable transaction alerts via SMS and email to monitor account activity in real_time. Regularly review your account statements for any unfamiliar transactions and report them to the bank immediately. If you suspect any fraudulent activity, you can report it by calling the national financial cybercrime helpline at 1930 or visiting cybercrime.gov.in.
