State Bank of India flags data breach after 3,897 customer records surface on the dark web

On 21 October 2026, the State Bank of India — the country's largest public-sector lender, serving hundreds of millions of customers — disclosed to the stock exchanges that it had identified 3,897 customer records containing personally identifiable information (PII) within data allegedly leaked on the dark web. The bank said the figure came from a preliminary review of roughly 375,000 records that were found circulating online, and that a detailed investigation into the source and extent of the exposure was under way.

SBI said it had first received alerts on 16 October 2026 from its threat-intelligence service provider and from India's national computer emergency response team, CERT-In, warning of a potential data exposure. The bank activated its cyber-incident response and containment procedures and engaged a CERT-In-empanelled independent cybersecurity firm to assess the reported breach. It characterised the incident as affecting a "very, very small number of customers" and said its core banking operations were not materially affected.

What data was involved

According to reporting on the disclosure, the identified records reportedly included mobile numbers, dates of birth, names, gender, email and residential addresses, and internal identifiers such as branch and CIF (Customer Information File) codes, along with loan and lead metadata. Early coverage indicated that no passwords, PINs, or OTPs were among the exposed fields, though that detail came from secondary commentary rather than the bank's filing and should be treated with caution.

Status

With the origin of the leak, the full scope of affected customers, and whether the data stemmed from SBI's own systems or a third party all still under investigation, the incident's status is ongoing. For a systemically important bank, even a limited exposure of customer PII raises the risk of targeted phishing and social-engineering fraud against the individuals whose details appeared online, which is why SBI said it was continuing to monitor the situation and coordinate with regulators.