The State Bank of India (SBI) on Wednesday said that a recent cyber incident involving a data leak affected a “very, very small number” of customers. The country’s
largest lender assured customers that the incident had no material impact on its information technology (IT) systems, core business operations, financial performance or business continuity. In a statement addressed to customers, SBI said customer balances remained completely safe and that it was taking all possible steps to protect their interests. The bank reiterated that safeguarding customers’ financial assets and data, along with maintaining their trust, remained its highest priorities. State Bank of India on Wednesday disclosed a cyberattack involving 3,897 customer records containing personally identifiable information which has reportedly been found on the dark web. In a statement to the exchanges, SBI said "on 16 October 2026, the Bank received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of the Bank’s customer data on the dark web. During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files." However as far as the initial probe and the extent to which data has been exposed, SBI said "a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank. The Bank promptly activated its cyber incident response and containment protocols. Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise."
