State Bank of India is addressing a reported data loss by hiring external cybersecurity experts to investigate. While the probe is ongoing, the bank has assured customers that its core banking operations remain unaffected and are functioning normally.
What We Know About the Incident
In late October 2026, State Bank of India confirmed it was investigating a cybersecurity incident. The announcement followed alerts on October 16 from its own threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) about a potential customer data exposure on the dark web. A preliminary analysis of approximately 375,000 records found online identified 3,897 customer records containing personally identifiable information (PII). The bank made the disclosure to the stock exchanges on October 21. The source and full extent of the data exposure are still under investigation.
SBI's Official Response and Actions
Upon receiving the alerts, SBI stated that it immediately activated its incident response and containment protocols. A key part of its response was the assurance that the incident has had no material impact on its core business operations, financial performance, or business continuity. In a public statement, SBI Chairman C.S. Setty confirmed the investigation is focused on containment, identifying vulnerabilities, and fixing any system gaps. The bank also stated that it had individually informed the affected customers via email and WhatsApp, reiterating that account balances and funds remain safe.
The Role of Independent Experts
To ensure a thorough and unbiased investigation, SBI engaged an independent cybersecurity agency empanelled by CERT-In. Bringing in third-party specialists is standard practice in such cases. These experts are tasked with conducting a comprehensive assessment to determine the nature, source, and extent of the compromise. Their involvement helps establish credibility and transparency in the investigative process. The goal is to get a clear picture of what happened, how it happened, and what risks it may pose to customers, allowing the bank to implement the necessary remedial and preventive measures.
What Kind of Data Was Exposed?
According to the bank's regulatory filing, the exposed information reportedly included customer names, mobile numbers, dates of birth, email addresses, and residential addresses. It also contained some internal identifiers like branch and Customer Information File (CIF) numbers, along with metadata related to loan records. Crucially, the bank's disclosure did not list highly sensitive financial data such as account numbers, passwords, PINs, OTPs, or card details. While the absence of this data is a relief, the exposure of personal information still creates a risk of sophisticated phishing, vishing (voice phishing), and other social engineering scams.
A Wider Trend of Financial Cyber Threats
The incident at SBI is not happening in isolation. It reflects a broader trend of increasing cyberattacks against India's banking, financial services, and insurance (BFSI) sector. Recently, CERT_In issued a critical warning about an AI_assisted cyberattack campaign dubbed 'Crafty Falcon', which targets financial institutions by automating attacks and exploiting payment APIs. Authorities have urged banks, NBFCs, and fintech companies to strengthen their security posture against these evolving, high_speed threats. Experts note that the average cost of a data breach in India's financial sector is higher than in any other industry, highlighting the significant risks involved.
What Should Customers Do Now?
For now, the most important message from SBI is that core banking systems are secure and funds are safe. However, vigilance is key. Customers should be extremely cautious of any unsolicited calls, SMS messages, or emails claiming to be from the bank. Scammers can use the leaked personal information to make their attempts seem more legitimate. It is crucial to never share passwords, OTPs, or other sensitive credentials. For any concerns or suspicious activity, customers should contact the bank directly through official channels and regularly monitor their account statements.
