The State Bank of India (SBI), the nation’s largest lender, has officially disclosed a data loss incident after a preliminary review flagged 3,897 customer records containing personally identifiable information (PII) circulating on the dark web.
The bank reported its findings in an official stock exchange filing on October 21, 2026, emphasising that investigators are still working to verify the authenticity, completeness, and exact origin of the leaked files.
Triggered by Threat Intelligence Alerts
The security alert trace began on October 16, when SBI received notifications from its threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) concerning a potential data exposure.
In response, bank specialists reviewed a broader dataset of roughly 375,000 dark web records. Officials noted that this larger figure represents total rows or entries—which often include redundancies and repetitive data—rather than a confirmed count of separate individual victims. Out of this review, 3,897 distinct customer records were confirmed to hold sensitive personal data.
What Data Was Exposed?
According to the bank’s preliminary assessment, the leaked fields extend beyond basic contact information. Exposed parameters include:
-
Personal Identifiers: Full names, gender, dates of birth, and email addresses.
-
Contact Details: Registered mobile numbers and residential addresses.
-
Banking Metadata: Branch details, Customer Information File (CIF) identifiers, lead IDs, and metadata linked to loan records.
Crucially, SBI confirmed that passwords, PINs, and one-time passwords (OTPs) were not included in the leaked data, and no unauthorised fund transfers or financial losses have been reported. Core banking infrastructure and business continuity mechanisms continue to function normally without disruption.
Independent Investigation Underway
SBI has swiftly enacted its cyber incident response protocols and enlisted an independent, CERT-In-empanelled cybersecurity agency to audit the situation. The ongoing forensic investigation aims to pinpoint the entry point, evaluate risks, and deploy necessary defensive measures.
While previous social media and forum claims have referenced a threat actor operating under the alias Siriusim, SBI’s current disclosures have not formally attributed the leak to a specific hacker group or vector.
What Customers Should Do
Though core systems are secure and financial credentials remain protected, security experts warn that exposed loan metadata and phone numbers could empower fraudsters to orchestrate highly convincing, targeted phishing calls.
Customers are strongly advised to:
-
Exercise extreme caution with unexpected texts, urgent account alerts, or unverified phone calls.
-
Never share sensitive credentials, PINs, or OTPs with anyone.
-
Routinely check bank statements for unauthorised activity and report suspicious communication immediately through official channels.
