The State Bank of India (SBI) confirmed that an investigation following a security incident first disclosed in October has identified personal customer information within an exposed dataset, raising concerns for millions of account holders.
What Exactly Happened?
On October
21, 2026, the State Bank of India formally disclosed it was investigating a cybersecurity incident. The bank was first alerted on October 16 by multiple agencies, including CERT-In (the Indian Computer Emergency Response Team), about a dataset circulating on the dark web that allegedly contained customer information. A preliminary analysis of a large dataset of roughly 375,000 records revealed that 3,897 of those records contained personally identifiable information (PII) of SBI customers. The bank has since engaged an independent cybersecurity agency to conduct a full investigation into the source, authenticity, and scope of the breach. While the number of confirmed records is relatively small compared to the bank's vast customer base, the nature of the exposed data is cause for significant concern.
What Specific Information Was Exposed?
According to SBI's disclosure and subsequent reports, the exposed data did not include core banking details like passwords, PINs, OTPs, or bank account numbers. Customer funds are considered safe. However, the leaked personal information is highly sensitive and provides potent material for fraudsters. The compromised data reportedly includes full names, registered mobile numbers, email addresses, residential addresses, and dates of birth. Additionally, some banking-related metadata such as branch details, customer information file (CIF) numbers, and information related to loan applications were also part of the leak. This combination of personal and financial context makes the exposed data particularly dangerous.
What Are the Risks for Customers?
The primary risk for the 3,897 affected customers—and a general warning for all banking consumers—is sophisticated and highly targeted fraud. With access to a person’s name, phone number, address, and knowledge of their banking relationship with SBI (including loan interests), scammers can craft incredibly convincing attacks. These can take the form of 'vishing' (voice phishing) calls or targeted SMS and email phishing campaigns. A fraudster posing as a bank employee, armed with these specific details, can more easily trick a victim into revealing sensitive information like OTPs or passwords, or into authorising fraudulent transactions. The data could also be used for identity theft or to apply for loans or credit cards in a victim's name.
What Is SBI's Response?
SBI has stated that the incident has not had a material impact on its core business operations or financial stability. The bank has assured customers that their account balances and funds remain secure. According to a statement from the bank on October 23, it has individually informed all customers whose data was identified in the breach via email and/or WhatsApp. The bank's chairman, C S Setty, has also pledged to strengthen the bank's cybersecurity framework to prevent future incidents and is working with the wider Indian banking sector to improve threat detection.
What Should You Do to Protect Yourself?
Even if you were not among the customers directly notified, this incident serves as a critical reminder to bolster your banking security. All SBI customers should consider taking the following steps immediately. First, be extremely vigilant about any unsolicited communication. Remember, SBI will never call or message you to ask for your PIN, OTP, password, or CVV. Treat any call, SMS, or email that creates urgency or asks for these details as a scam, even if the sender knows your personal information. Second, regularly monitor your bank statements and transaction alerts for any unauthorised activity. Report any suspicious transactions to the bank immediately by calling the national cybercrime helpline at 1930. Third, consider changing your internet banking and YONO app passwords as a precaution. Finally, if you receive a suspicious email, forward it to SBI's official phishing report address: report.phishing@sbi.co.in.
