India's largest lender has confirmed that some of its customers' personal details have surfaced on the dark web. State Bank of India (SBI) told the stock exchanges on October 21, 2026, that a preliminary look at about 3.75 lakh records linked to the bank found 3,897 customer records containing personally identifiable information, and that a detailed investigation is now under way.
The bank says its core banking systems are running normally and that the incident has had no material impact on its operations or finances. But for customers, the bigger worry is what fraudsters can do with personal details like mobile numbers, birth dates and home addresses.
How the Leak Came to Light
According to the bank's disclosure, SBI received alerts on October 16 about a suspected exposure of customer data. The warnings came from its threat intelligence service provider, the Defence Cyber Agency, and from CERT-In, the Indian Computer Emergency Response Team that handles cyber incidents nationally.
Separately, a threat actor using the name "Siriusim" has claimed online to hold around 3.75 lakh rows of SBI-linked data along with 2,722 PDF documents, including loan applications and account-opening forms. These claims have not been independently verified. It is important to note that the 3.75 lakh figure refers to records examined, not the number of customers affected. SBI's own preliminary finding is 3,897 records with personal information.
What Data Was Exposed
Based on the bank's preliminary analysis, the exposed records include:
| Records examined | About 3.75 lakh |
| Records with personal data | 3,897 |
| Personal details | Names, gender, registered mobile numbers, dates of birth, email addresses, residential addresses |
| Bank-related details | Branch details, customer information file (CIF) identifiers, lead IDs, loan and lead metadata |
| Alert received | October 16, 2026 |
| Alert sources | Defence Cyber Agency and CERT-In |
| Impact on operations | None material, as per SBI |
There is no indication in the bank's disclosure that passwords, PINs or card numbers were part of the exposed data. Still, the mix of names, phone numbers and loan-related details is exactly the kind of information scammers use to make fake calls and messages sound convincing.
What SBI Is Doing
SBI says it has activated its cyber incident response and containment protocols. It has also brought in an independent, CERT-In-empanelled cybersecurity agency to check whether the data is authentic and complete, find the likely source and extent of the exposure, and assess the risk to customers and the bank. Remedial and preventive steps are being put in place while the assessment continues.
What It Means for SBI Customers
For most account holders, money in the bank is not directly at risk from this kind of leak. The danger is social engineering. A fraudster who knows your name, birth date, branch and that you enquired about a loan can call pretending to be from SBI and sound very believable. That is often how people are tricked into sharing OTPs or installing remote-access apps.
How to Protect Yourself: Step by Step
- Never share OTPs, PINs, CVV or passwords with anyone, even if the caller knows your personal details and claims to be from the bank.
- Be wary of loan-related calls and messages, since part of the exposed data relates to loan leads.
- Don't click links in SMS, email or WhatsApp asking you to "update KYC" or "unblock" your account. Use the official app or visit your branch instead.
- Never install screen-sharing or remote-access apps on a caller's instruction.
- Turn on transaction alerts and check your statement regularly for unfamiliar activity.
- Report fraud immediately to the bank and on the national cybercrime helpline 1930 or cybercrime.gov.in.
Part of a Growing Pattern
SBI is not the first Indian financial company to face such a disclosure. Customer data from several insurers and brokers has surfaced online in recent years, and banks are increasingly warning customers about AI-generated voice clones and deepfake calls. With more banking moving to phones, the weakest link is often not the bank's core systems but the personal data that sits around them.
What Happens Next
The independent agency's investigation should establish whether the data is genuine, where it leaked from and how many customers are truly affected. SBI may need to update the exchanges if the findings are material. Until then, customers are best served by staying alert to unexpected calls and messages that mention their account or loan.
Comments (0)