Key Takeaways
- The SBI data breach investigation identified 3,897 customer records containing personal information.
- The bank reviewed approximately 375,000 records after receiving cyber threat alerts.
- SBI said its core banking services continued without any material operational impact.
State Bank of India (SBI) has reported an SBI data breach incident after identifying 3,897 customer records containing personal information on the dark web. In an October 21, 2026, stock exchange filing, the bank said investigators were still checking the data’s authenticity, completeness, and source. SBI reported no material impact on its core operations, financial performance, or business continuity.
SBI data breach: customer information found on dark web
SBI said it received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). The alerts concerned the suspected exposure of customer information on the dark web.
As part of the SBI data breach investigation, the bank reviewed approximately 375,000 records and identified 3,897 customer records containing personally identifiable information. The larger figure refers to the records reviewed, not the number of confirmed affected customers. SBI has not yet established the full scope of the exposure.
The information reportedly included customer names, registered mobile numbers, dates of birth, gender, email addresses, and residential addresses. The records also contained branch details, customer information file identifiers, lead IDs, and metadata linked to loan and lead records.
The SBI customer data breach could raise concerns about criminals using exposed personal information to make fraudulent banking calls or messages appear genuine. However, SBI has not confirmed that such fraud has occurred because of this incident.
The bank’s filing did not list passwords, personal identification numbers (PINs), or one-time passwords (OTPs) among the identified information. It also did not report any stolen funds. Investigators still need to establish how the information reached the dark web and whether it came from SBI’s systems or another source.
SBI data breach investigation and cybersecurity response
Following the suspected SBI data breach, the bank activated its cybersecurity response procedures after receiving the alerts. It also engaged an independent cybersecurity agency approved by CERT-In to assess the incident and examine the suspected exposure.
The investigation will focus on checking whether the records are genuine and complete, identifying their possible source, measuring the extent of the exposure, and assessing risks to customers and the bank. SBI said it was taking remedial and preventive steps as required.
The filing did not identify a specific attacker, software flaw, compromised server, or method used to obtain the information. The bank has not attributed the incident to ransomware, phishing, or any other specific attack method.
The SBI data breach highlights the need for Indian businesses to protect customer records, strengthen cybersecurity measures, and monitor potential data exposure. Banks and other firms that handle personal and financial information may face risks when criminals use such details to impersonate trusted organisations.
Customers should be cautious about unexpected calls, messages, and emails that refer to their banking details. They should verify requests through official banking channels and never share PINs or OTPs. They should also review account statements and report any unfamiliar transactions to their bank.
SBI said its services continued to operate normally. The bank’s investigation remains ongoing, and further findings are needed to establish the origin of the records, the full extent of the exposure, and any confirmed impact on customers.
