State Bank of India has said the bank has individually notified all customers whose data was identified as being involved in the recent cyber incident.
The bank said customers have been informed via email and/or WhatsApp. SBI also assured all customers that their account balances and funds remain safe and urged customers to follow safe digital banking practices (given below is the image of the bank's statement). On Wednesday October 21, 2026; State Bank of India had disclosed a cyberattack involving 3,897 customer records containing personally identifiable information that had reportedly been found on the dark web. In a statement to the exchanges the bank had earlier stated, "on 16 October 2026, the bank received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of the Bank’s customer data on the dark web. During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files." On the initial probe SBI had stated, "a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank. The Bank promptly activated its cyber incident response and containment protocols. Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise. We wish to submit that this does not have any material impact on the bank's core business operations, financial performance or business continuity." However experts believe this incident raises broader concerns on customer data protection and exposed personal information can increase the risk of phishing attacks, identity theft and financial fraud.
