State Bank of India (SBI) is investigating a troubling data security incident after thousands of customer records surfaced on the dark web. While the bank is assessing the situation, here’s a clear breakdown of what happened and what it means for you.
What We Know Happened
On October 16, 2026, State Bank of India received alerts from multiple cybersecurity bodies, including the Indian Computer Emergency Response Team (CERT-In) and the Defence Cyber Agency. The warnings pointed to a dataset circulating on the dark web that allegedly contained SBI customer information. A threat actor known as 'Siriusim' had posted a large collection of data for sale on a cybercrime forum. In response, SBI launched a full investigation, stating it had activated its incident response protocols and appointed an independent cybersecurity agency to assess the breach.
Thousands of Records Confirmed
The initial dark web posting claimed to contain approximately 375,000 records. After a preliminary analysis, SBI confirmed that it had identified 3,897 records containing the personally identifiable information (PII) of its customers within that larger dataset. The bank has been clear that a detailed investigation is still needed to establish the authenticity and source of all the data. SBI Chairman C.S. Setty acknowledged the incident as 'definitely an issue of concern' and stated that a root cause analysis was underway.
What Specific Data Was Exposed?
According to the bank's own disclosure, the compromised information for the 3,897 confirmed records includes a range of personal details. This includes customer names, registered mobile numbers, dates of birth, email addresses, and residential addresses. Furthermore, internal banking identifiers like branch details, Customer Information File (CIF) numbers, and metadata related to loans were also part of the leak. Crucially, SBI has stated that core banking details such as account balances, passwords, or PINs were not compromised, and the incident has had no material impact on its financial operations.
The Real Risk: Phishing and Scams
While the absence of direct financial credentials is a relief, the leaked data poses a significant secondary risk: sophisticated phishing attacks. With access to names, phone numbers, and even loan-related information, fraudsters can craft highly convincing fake emails and calls pretending to be from SBI. They can use these details to build trust and trick customers into revealing sensitive information like OTPs or login passwords. Digital rights organisation Internet Freedom Foundation warned that affected customers are highly likely to receive such calls from scammers who can recite their personal details back to them.
What SBI Customers Should Do Now
Vigilance is the most powerful tool for customers right now. First and foremost, never share your OTP, PIN, password, or card details with anyone, even if they claim to be an SBI official. The bank has repeatedly stated it will never ask for this information. Be extremely suspicious of any unsolicited calls, text messages, or emails about your account. If you receive a suspicious message, do not use any links or phone numbers provided in it. Instead, contact the bank directly using the official number on the back of your card or through the official YONO app. Regularly monitor your account statements for any unusual activity and report any suspected fraud immediately to the bank and the national cybercrime helpline at 1930.
