SBI Data Breach Review: 3,897 Customer Records Found on Dark Web
In short
State Bank of India confirmed that 3,897 customer records containing PII appeared on the dark web after alerts from CERT-In and the Defence Cyber Agency.
State Bank of India confirmed on October 21, 2026, that 3,897 customer records had been identified on the dark web. The disclosure followed preliminary analysis of roughly 375,000 rows of data reported by threat actors. Account balances remain unaffected and core operations continue without interruption.
SBI Data Breach Details and Exposed Information
The incident came to light after SBI received alerts on October 16, 2026, from its threat intelligence provider, the Defence Cyber Agency, and CERT-In. Threat actor claims posted between October 16 and 19 referenced approximately 3.75 lakh rows in CSV and PDF formats linked to SBI customer and lead data. SBI's regulatory filing with stock exchanges limited the verified exposure to the smaller confirmed set of records.
Exposed fields reportedly include names, gender, dates of birth, mobile numbers, email addresses, residential addresses, branch details, Customer Information File identifiers, lead IDs, and metadata tied to loan or lead records. The bank stated that the affected portion represents a very small fraction of its customer base. No evidence of impact on transaction systems or financial balances has been reported.
SBI engaged an independent CERT-In-empanelled cybersecurity firm to conduct a full assessment. The investigation continues to determine the source of the exposure, verify data authenticity, and measure potential customer risk. As of the filing date, no additional public updates on investigation outcomes had been issued.
Bank Response and Customer Protections
SBI activated its incident response protocols immediately after the alerts. The bank issued a public statement on X reassuring customers that balances are safe and that steps are underway to protect customer interests. Digital rights group Internet Freedom Foundation noted that while SBI notified exchanges, direct notification to affected individuals had not yet occurred by the time of the October 21 filing.
Remedial and preventive measures will be implemented based on the independent agency's findings. SBI continues to monitor the situation and comply with regulatory reporting requirements. Customers concerned about their data can contact the bank through official channels listed on its website for specific account inquiries.
Current Status of the Investigation
The scope and origin of the exposure remain under review. SBI emphasized that the incident produced no material effect on business continuity or financial performance. Further updates are expected once the independent assessment concludes and regulatory notifications are complete.
- Monitor official SBI communications for any direct outreach.
- Review account statements regularly for unusual activity.
- Enable additional authentication features where available.
- Report suspected misuse of personal data to the bank and relevant authorities.
Frequently asked questions
What data appeared in the SBI data breach?
The confirmed records contain names, dates of birth, mobile numbers, email addresses, addresses, branch details, CIF identifiers, and loan-related metadata. Account balances and transaction systems were not affected.
How many records were confirmed exposed?
SBI verified 3,897 customer records after analyzing roughly 375,000 rows reported on dark web forums. The remaining data's authenticity is still under review.
Did SBI notify customers directly?
As of the October 21, 2026 filing, SBI had informed stock exchanges and regulators but had not yet issued direct notifications to affected individuals.
What should customers do after the SBI data breach?
Customers should monitor official SBI channels, review statements for anomalies, and contact the bank with specific concerns about their accounts.
TrustScope
Comments 9