SBI Data Breach: 3,897 Customer Records Found on Dark Web, Investigation Underway

India’s largest public sector lender, the State Bank of India (SBI), is investigating a suspected customer data breach after identifying 3,897 records containing personally identifiable information (PII) in data discovered on the dark web. The incident has raised fresh concerns about banking cybersecurity, customer privacy and the potential misuse of sensitive financial information.

In a disclosure to stock exchanges on October 21, 2026, SBI confirmed an incident involving the loss of certain customer data. The bank said a preliminary examination of approximately 3.75 lakh records available on the dark web identified 3,897 records containing personal information. The investigation is ongoing, and the exact source and extent of the exposure have not yet been established.

Source: NDTV – SBI Data Leak: What Happened, What Data Was Leaked and What Account Holders Must Do

According to SBI’s preliminary findings, the exposed records included several categories of customer information:

The bank has not yet established the authenticity and completeness of all the data or determined how it became available online. Reports have also referred to claims of a much larger dataset containing hundreds of thousands of entries and thousands of PDF documents. However, the full contents and relationship of those materials to the confirmed customer records remain subject to verification.

The distinction is important: identifying personal information in an exposed dataset does not automatically mean that all affected bank accounts were accessed or that money was stolen. SBI has not established that customers’ passwords, PINs or account credentials were compromised in this incident.

Source: The Hindu – SBI Data Breach: How the Bank Discovered the Leak and What Followed

SBI said it received alerts on October 16, 2026, from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In), regarding the suspected exposure of customer data on the dark web.

Following these alerts, the bank activated its cyber incident response and containment protocols. It also engaged an independent cybersecurity agency empanelled by CERT-In to investigate the nature, origin and extent of the suspected compromise.

The investigation is expected to help establish whether the information originated from SBI’s own systems, a third-party service provider or another source. Until the assessment is complete, the precise cause of the incident remains unconfirmed.

SBI has stated that the incident has had no material impact on its core business operations, financial performance or business continuity. Its banking services continue to operate normally, according to the bank’s disclosure.

Source: NDTV – SBI Data Leak and Cybersecurity Investigation

Even when account passwords or transaction credentials are not confirmed to have been exposed, personal information can be valuable to cybercriminals.

Fraudsters may use leaked names, phone numbers, addresses and loan-related details to make fraudulent calls or messages appear genuine. For example, a scammer could impersonate an SBI employee, refer to a customer’s personal information and claim that an account, loan application or identity verification process requires urgent attention.

Such tactics can increase the risk of phishing, identity theft, social engineering attacks and unauthorised financial activity. Customers may be more likely to trust a caller who already knows details about them.

The incident also highlights the importance of protecting customer information across the entire banking ecosystem, including third-party platforms, document-processing systems and other services that handle financial records. However, no specific vulnerability or entry point has been confirmed as the cause of this incident.

While the investigation continues, SBI account holders should remain vigilant and follow basic banking security practices:

Customers should not assume their accounts have been hacked solely because their personal information may have appeared in the exposed dataset. Instead, they should take sensible precautions and respond promptly to any signs of suspicious activity.

SBI’s independent cybersecurity assessment remains central to determining the source of the exposed information, the full scope of the incident and the measures needed to prevent further exposure. The bank has said it is implementing appropriate remedial and preventive measures in line with applicable regulatory requirements.

The incident adds to growing concerns over data protection and cyber risks facing India’s financial sector. As banks increasingly rely on interconnected digital systems and external service providers, safeguarding personal information requires security measures that extend beyond core banking infrastructure.

For SBI customers, the immediate priorities are to stay alert to impersonation scams, protect authentication details and use official channels to report suspicious activity. Further clarity on the breach will depend on the findings of the ongoing investigation.