SBI Investigates Suspected Customer Data Exposure
The State Bank of India (SBI) is investigating a suspected data exposure after a preliminary review identified 3,897 customer records containing personally identifiable information among approximately 3.75 lakh records found on the dark web. The bank disclosed the incident on October 21, 2026.
SBI said it received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). It activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency to investigate.
What Customer Information May Have Been Exposed
The identified records reportedly contained names, gender, mobile numbers, dates of birth, email and residential addresses, branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan or lead records.
The preliminary review examined approximately 3.75 lakh records found on the dark web and identified 3,897 records containing personally identifiable information. The remaining records have not been fully explained in the public disclosure, and the full scope of the exposure remains under investigation.
SBI Says Banking Operations Remain Unaffected
SBI stated that the incident has had no material impact on its core business operations, financial performance or business continuity. The bank also said customer account balances remain safe. The public disclosure does not establish that customer funds were stolen or that unauthorised transactions occurred as a result of the incident.
However, exposed personal information can create risks even when account balances are unaffected. Fraudsters may use names, phone numbers, dates of birth and other details to make fraudulent calls or messages appear genuine.
What Should SBI Customers Do?
Be cautious of unexpected calls and messages, even if the caller knows personal details. Never share OTPs, passwords, PINs or other banking credentials with callers claiming to represent the bank.
Avoid suspicious links in messages asking you to verify an account, update KYC details or resolve an alleged security issue. Review account activity and contact SBI through verified official channels if you notice anything suspicious.
Has SBI Identified the Source of the Leak?
The source of the suspected exposure has not been established in the bank’s public disclosure. The investigation is expected to examine the authenticity of the records, how the information may have become accessible and the extent of any customer impact.
Until that investigation is completed, it would be premature to attribute the exposure to a particular hacker, cybercriminal group, employee, vendor or vulnerability.
Why the Incident Matters
The incident highlights the importance of protecting personal information held by financial institutions. Even when financial systems continue operating normally, exposed customer data can increase the risk of targeted phishing, impersonation and social-engineering scams.
