State Bank of India (SBI) has disclosed a data-loss incident after a preliminary review of approximately 3.75 lakh records found on the dark web identified 3,897 customer records containing personally identifiable information. The disclosure, made on 21 October 2026, has raised concerns about customer privacy and the potential misuse of personal information, even as the bank says its core operations remain unaffected.
The exposed information reportedly includes names, registered mobile numbers, dates of birth, email addresses, residential addresses and identifiers linked to customer and loan records. SBI has appointed an independent cybersecurity agency to investigate the incident and establish the authenticity, source and extent of the data exposure.
How SBI Discovered the Data Leak
SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure of customer data on the dark web.
The bank then reviewed approximately 3.75 lakh records available online. Its preliminary analysis identified 3,897 records containing personally identifiable information associated with customers.
The investigation is still underway. SBI has said further assessment is required to determine whether the exposed information is authentic and complete, how it became available online, and what risks the incident may pose to customers and the bank.
The bank has activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled with CERT-In to conduct a comprehensive assessment.
What SBI Customer Information Was Exposed?
According to the bank’s disclosure and reports published on 21 October, the information identified during the preliminary review includes several categories of personal and banking-related data.
Reportedly exposed information includes:
- Customer names and gender
- Registered mobile numbers
- Dates of birth
- Email addresses and residential addresses
- Branch details and Customer Information File (CIF) identifiers
- Lead IDs and metadata associated with loan and lead records
The disclosure does not establish that every record in the larger dataset contains SBI customer information. Nor has the bank publicly established the complete scope of the exposure.
The distinction matters because the 3,897 records were identified during a preliminary examination of a much larger collection of records found online. The investigation must establish which information is genuine, how it was obtained and whether additional customer records are involved.
Does the SBI Data Leak Put Bank Accounts at Risk?
The exposure of personal information does not automatically mean that customer accounts have been accessed or that money has been stolen. SBI has said the incident is not expected to have a material impact on its core business operations, financial performance or business continuity.
However, the absence of a reported operational impact does not make the exposure harmless.
Personal details such as names, phone numbers, dates of birth and addresses can help fraudsters make calls and messages appear more credible. If loan-related information or customer identifiers are also accurate, criminals may use those details to impersonate bank representatives or create convincing stories about pending payments, loan applications or account verification.
Customers should therefore remain alert to attempts to obtain passwords, PINs, one-time passwords (OTPs) or other confidential banking information.
At this stage, there is no basis to conclude that every customer whose information may have appeared in the dataset has experienced financial loss. The extent of any misuse, if it has occurred, remains unclear.
How Customers Can Protect Themselves
Customers do not need to panic, but they should take sensible precautions against phishing, impersonation and other forms of financial fraud.
Be cautious of calls claiming to be from SBI
Fraudsters may use genuine personal information to convince customers that a call is legitimate. Do not trust a caller merely because they know your name, mobile number, address or loan details.
End suspicious calls and contact the bank through its official website, verified customer-service channels or your branch.
Never share OTPs, PINs or passwords
Do not disclose OTPs, ATM or debit card PINs, internet banking passwords or other authentication details to callers or people contacting you through messaging apps.
A caller claiming that your account will be blocked, your loan cancelled or your information deleted unless you act immediately should be treated with suspicion.
Avoid suspicious links and applications
Do not click links in unexpected SMS messages, emails or WhatsApp messages claiming to offer a data-breach check, account protection or urgent KYC verification.
Access banking services through the bank’s official website or application rather than links supplied by unknown senders.
Monitor transactions and banking alerts
Review account activity and pay attention to transaction alerts. If you notice an unauthorised transaction or receive a suspicious request involving your account, contact SBI promptly using a verified channel.
Customers should also be wary of unexpected loan-related messages, requests for fees or documents, and offers to help recover money or secure an account.
Report suspected financial fraud quickly
If money has been lost to cyber fraud in India, report the incident immediately through the national cybercrime helpline at 1930 and the official National Cyber Crime Reporting Portal. Prompt reporting can help authorities and financial institutions take action.
SBI Says Core Operations Remain Unaffected
SBI has stated that the incident is not expected to have a material impact on its core operations, financial performance or business continuity.
The bank’s disclosure does not, however, resolve all questions about the incident. Its investigation must still establish the source of the data, the extent of the exposure and the risks arising from the information found online.
The bank has not publicly established through its preliminary analysis whether the dataset is complete or how the information became available. The findings of the independent cybersecurity assessment should provide greater clarity on those questions.
What Happens Next?
The immediate priorities are to establish the authenticity of the exposed information, determine how it became accessible and identify any further risks to affected customers. The investigation may also clarify whether the exposure resulted from a compromise of SBI’s systems, another source or a combination of factors.
For customers, the most immediate concern is the potential misuse of personal information in phishing and impersonation attempts. Even where account balances and core banking services are unaffected, exposed personal details can create risks that continue beyond the initial incident.
SBI’s disclosure confirms that 3,897 customer records containing personally identifiable information were identified in its preliminary review. The full scope, source and consequences of the exposure remain under investigation. Customers should stay vigilant while awaiting further information from the bank.
