News Data Breaches

SBI confirms data leak: personal details of 3,897 customers exposed after bank records surface on the dark web

State Bank of India told stock exchanges on 21 October 2026 that about 375,000 records were found on the dark web, of which 3,897 contained customers' personal information such as names, mobile numbers, dates of birth and addresses.

Published Updated
Illustration of a bank vault door with the SBI logo, leaking customer record cards into a dark web marketplace below.

Key takeaways

  • SBI disclosed a data loss incident to stock exchanges on 21 October 2026.
  • About 375,000 records were found on the dark web, 3,897 of them with customers' personal information.
  • Exposed fields include names, mobile numbers, dates of birth, emails, addresses and loan lead details.
  • SBI was alerted on 16 October by its threat intelligence provider, the Defence Cyber Agency and CERT-In.
  • SBI says core operations are not materially affected; the cause has not been disclosed.

State Bank of India (SBI), India's largest bank, has confirmed an incident "involving data loss" after customer data was reportedly exposed on the dark web. The bank disclosed it in a filing to Indian stock exchanges dated 21 October 2026.

What did SBI disclose? #

According to the filing, SBI received alerts on 16 October 2026 from its threat intelligence service provider, India's Defence Cyber Agency and CERT-In about suspected exposure of customer data.

Detail What SBI said
Records found on the dark web About 375,000
Records with customers' personal information 3,897
Date alerted 16 October 2026
Investigation An independent CERT-In-empanelled cybersecurity agency
Impact on operations No material impact on core business operations

What data was exposed? #

SBI lists the following fields in the affected records:

  • Registered mobile numbers
  • Names, gender and dates of birth
  • Email addresses and residential addresses
  • Branch and CIF (customer information file) identifiers
  • Lead IDs and metadata for loan and lead records and related files

The filing does not mention account passwords, card numbers or account balances.

How did the data leak? #

SBI has not said. The filing does not name an attacker, a cause or which system the data came from. It says the bank is monitoring the situation and putting remedial and preventive measures in place.

Why does this matter? #

Even without passwords, names, phone numbers, dates of birth and loan details are exactly what fraudsters use to make calls and messages look genuine. Customers with loans or loan enquiries may be targeted with fake offers or recovery calls that quote real details.

What should SBI customers do? #

  1. Treat unexpected calls, SMS, WhatsApp messages or emails about your account or loan with suspicion, even if they quote your real details.
  2. Never share OTPs, PINs, passwords or card details. Banks do not ask for them.
  3. Do not click links or install apps sent in messages claiming to be from SBI.
  4. Check your account and loan statements for activity you do not recognize.
  5. In India, report cyber fraud to the national cybercrime helpline 1930 or cybercrime.gov.in.

Sources

  1. SBI stock exchange disclosure on data loss incident, State Bank of India (NSE filing)

Questions this raises

Were passwords or card numbers leaked?
SBI's filing does not list passwords, card numbers or balances among the exposed fields.
How many customers are affected?
SBI says 3,897 customer records contained personal information, out of about 375,000 records found on the dark web.
Who is investigating?
SBI says it engaged an independent cybersecurity agency empanelled by CERT-In.

Data BreachData LeakBanking SecurityFinancial CybersecurityPrivacyIndiaSBI