SBI Data Leak 2026: 3,897 Customer Records Found on Dark Web

State Bank of India (SBI), India's largest public-sector bank, has disclosed a data-loss incident after identifying 3,897 records containing customer-related personal information in a dataset of approximately 375,000 records reportedly circulating on the dark web.

In a stock-exchange filing dated October 21, 2026, the bank confirmed that it had experienced an incident involving the loss of certain data. However, the source of the information, the authenticity of the exposed records, and the full extent of the incident remain under investigation.

What Happened in the SBI Data Leak?

SBI reportedly received an alert about the incident on October 16, 2026, through its threat intelligence provider, the Indian Computer Emergency Response Team (CERT-In), and the Defense Cyber Agency.

The bank activated its incident response and containment procedures and appointed an independent cybersecurity firm from CERT-In's approved panel of security auditors to investigate the alleged compromise.

According to the preliminary assessment, 3,897 records containing personal information were identified within the larger dataset. SBI has not confirmed whether all the records are authentic or whether the information originated from its own systems, a subsidiary, or a third-party service provider.

What Customer Information Was Exposed?

According to the bank's filing, the information reportedly included:

• Customer names and registered mobile numbers

• Dates of birth and gender

• Email addresses and residential addresses

• Bank branch information

• Customer Information File (CIF) identifiers

• Lead identification numbers

• Metadata associated with loan applications and related records

The filing does not list account balances, passwords, OTPs, card details, PAN numbers, or Aadhaar numbers among the reported categories of exposed information. However, the investigation has not established the complete contents of the alleged dataset.

Hackers Allegedly Claimed 375,000 Records

A threat intelligence monitoring account reported a claim attributed to a threat actor using the name Siriusim. The actor allegedly claimed to possess approximately 375,000 rows of data in CSV format and 2,722 PDF documents.

The documents were reportedly associated with customer information, loan applications, supporting documents, account-opening forms, and addresses.

The Free Press Journal reported examining four sample records posted with the alleged listing. Its report stated that the phone numbers in the samples were valid and that one WhatsApp profile photograph matched a photograph in a posted KYC document.

However, these limited checks do not establish that the entire dataset is genuine or that the information was obtained directly from SBI's systems.

Has SBI Confirmed a Cyberattack?

SBI has confirmed a data-loss incident, but its public disclosure does not establish that its core banking systems were hacked.

Investigators are still working to determine the source of the information, the extent of the exposure, and the potential risks to customers.

The data could potentially have originated from SBI, one of its subsidiaries, or an external service provider. These possibilities have not been confirmed.

The bank stated that the incident had no material impact on its core business operations, financial performance, or business continuity. However, this does not mean that customers face no privacy or security risks.

Why Is the Data Leak a Concern?

Even without confirmed exposure of banking passwords or account credentials, personal information can be valuable to cybercriminals.

Exposed names, phone numbers, dates of birth, addresses, and loan-related details could potentially be used in targeted phishing campaigns, fraudulent calls, identity misuse, and social engineering attacks.

Scammers may impersonate bank employees and use genuine customer details to make fraudulent messages appear legitimate.

Customers should therefore remain cautious when receiving unexpected calls or messages about loans, KYC verification, account restrictions, or suspicious transactions.

What Should SBI Customers Do?

SBI customers should follow these security precautions:

• Never share OTPs, ATM PINs, CVVs, or internet banking passwords.

• Do not click suspicious links or install applications requested by unknown callers.

• Verify banking communications through SBI's official website or customer-service channels.

• Monitor account transactions and banking alerts regularly.

• Report suspected cybercrime in India by calling 1930 or using the National Cyber Crime Reporting Portal.

Customers should not assume a caller is genuine simply because the person knows their personal information.

SBI's Response to the Incident

SBI has activated its incident response and containment procedures and engaged an independent cybersecurity firm to assess the alleged compromise.

As of October 21, 2026, the bank had not publicly established the original source of the data or confirmed the full scope of the exposure. Its filing also did not specify whether potentially affected customers had been notified.

Conclusion

The SBI data-loss disclosure highlights the security risks associated with personal information in the banking sector.

Although the bank has acknowledged an incident, questions remain about the origin of the data, the authenticity of the alleged dataset, and whether the incident involved SBI systems or a third-party service provider.

Customers should remain alert to suspicious banking communications while the investigation continues.

Official source: https://nsearchives.nseindia.com/corporate/SBIN_21102026084938_BSE_NSE_21102026.pdf

SBI Cyber Security: https://sbi.bank.in/web/personal-banking/cyber-security

Disclaimer: This article is based on SBI's public disclosure and published reports available as of October 21, 2026. The investigation is ongoing, and the full extent of the alleged data exposure has not been independently established.