India's largest lender, the State Bank of India, is currently investigating a suspected data compromise, raising concerns among its millions of customers. While the bank has not confirmed a wide-scale impact, here is what is known so far.
What We Know So Far
In late October
2026, the State Bank of India (SBI) disclosed that it was investigating a potential data leak after being alerted by CERT-In, India's national cybersecurity agency. A preliminary analysis of around 375,000 records found on the dark web revealed that 3,897 contained personally identifiable information (PII) of customers. SBI publicly confirmed the investigation in a disclosure to the stock exchanges, stating it had engaged an independent cybersecurity firm to assess the nature and extent of the compromise. The bank has stressed that its core banking systems remain secure and that the incident has had no material impact on its financial operations.
Understanding the Exposed Data
The compromised information appears to be what is known as personally identifiable information. Reports indicate that the exposed data includes customer names, registered mobile numbers, email addresses, dates of birth, and residential addresses. Additionally, some loan-related metadata, branch identifiers, and Customer Information File (CIF) numbers were part of the leak. It is crucial to note that, according to the bank's statements, financial details like account balances, transaction histories, or passwords were not part of this specific exposure. The source of the leak is still under investigation, with possibilities pointing towards the bank's own systems, a third-party vendor, or a connected loan-processing provider.
The Bank's Official Response
SBI has moved to reassure its customers and the market. SBI Chairman C.S. Setty stated that cybersecurity is of 'paramount importance' and that the incident has strengthened the bank's resolve to enhance its security framework. The bank confirmed it is conducting a comprehensive cybersecurity drill, including assessments of its Application Programming Interfaces (APIs), to identify and fix any vulnerabilities. Following some criticism, SBI also stated that it had individually informed the 3,897 identified customers via email or WhatsApp, reiterating that their funds were safe. The bank is also working with the Indian Banks' Association (IBA) to create a better system for sharing threat intelligence across the financial sector.
Potential Risks for Customers
Even without direct financial data, the leak of personal information poses significant risks. This type of data is a goldmine for fraudsters, who can use it to carry out sophisticated phishing and 'vishing' (voice phishing) attacks. Scammers might use the leaked names, mobile numbers, and address details to create highly convincing fake emails or calls, pretending to be from SBI. Their goal would be to trick customers into revealing more sensitive information like their online banking passwords, debit card PINs, or One-Time Passwords (OTPs). This could lead to unauthorised transactions and financial loss.
What Customers Should Do Now
Vigilance is key. All SBI customers, whether they have been notified or not, should adopt a cautious approach. First, be extremely wary of any unsolicited calls, SMS messages, or emails claiming to be from the bank. Remember, SBI will never ask for your password, PIN, or OTP. It is highly recommended to change your internet and mobile banking passwords as a precaution. Regularly monitor your account statements for any unfamiliar transactions, no matter how small. Enabling two-factor authentication (2FA) on all banking and financial accounts provides a critical layer of security. If you notice any suspicious activity, you should immediately contact the bank through its official helpline and report the incident to the National Cyber Crime Helpline by dialling 1930.
