38
The State Bank of India (SBI) is investigating a suspected data exposure after a preliminary analysis identified 3,897 customer records containing personally identifiable information among data found on the dark web.
In a disclosure dated October 21, 2026, the country’s largest public-sector lender said it had reviewed approximately 375,000 records available online. The initial assessment identified records containing sensitive customer information, although the authenticity of the data and the full extent of the exposure remain under investigation.
The potentially exposed information includes customers’ names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. The records also contain branch details, Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan and lead records.
SBI said it received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
Following the alerts, the bank activated its cyber incident response and containment protocols. It also engaged an independent cybersecurity agency empanelled by CERT-In to investigate the incident.
The assessment is intended to establish the authenticity and completeness of the records, identify the possible source of the exposure and evaluate the potential risks to customers and the bank.
SBI said the incident had no material impact on its core business operations, financial performance or business continuity. The bank’s operations continue normally.
The suspected exposure raises concerns about the potential misuse of personal information in phishing campaigns, impersonation attempts and targeted financial fraud. Criminals could use such information to make fraudulent communications appear more credible and persuade victims to disclose additional sensitive details.
Customers should remain cautious of unsolicited calls, messages and emails requesting banking credentials, passwords or one-time passwords (OTPs). They should avoid sharing confidential banking information and verify suspicious communications through official bank channels.
The investigation remains ongoing. Its findings are expected to provide greater clarity on the authenticity of the exposed records, the possible source of the data and the potential risks to affected customers.
In a disclosure dated October 21, 2026, the country’s largest public-sector lender said it had reviewed approximately 375,000 records available online. The initial assessment identified records containing sensitive customer information, although the authenticity of the data and the full extent of the exposure remain under investigation.
The potentially exposed information includes customers’ names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. The records also contain branch details, Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan and lead records.
SBI said it received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
Following the alerts, the bank activated its cyber incident response and containment protocols. It also engaged an independent cybersecurity agency empanelled by CERT-In to investigate the incident.
The assessment is intended to establish the authenticity and completeness of the records, identify the possible source of the exposure and evaluate the potential risks to customers and the bank.
SBI said the incident had no material impact on its core business operations, financial performance or business continuity. The bank’s operations continue normally.
The suspected exposure raises concerns about the potential misuse of personal information in phishing campaigns, impersonation attempts and targeted financial fraud. Criminals could use such information to make fraudulent communications appear more credible and persuade victims to disclose additional sensitive details.
Customers should remain cautious of unsolicited calls, messages and emails requesting banking credentials, passwords or one-time passwords (OTPs). They should avoid sharing confidential banking information and verify suspicious communications through official bank channels.
The investigation remains ongoing. Its findings are expected to provide greater clarity on the authenticity of the exposed records, the possible source of the data and the potential risks to affected customers.
