The State Bank of India (SBI), the country’s largest public sector lender, has reported a cybersecurity incident after identifying thousands of customer records containing personal information in data found on the dark web. According to the bank’s regulatory disclosure on October 21, 2026, a preliminary examination identified 3,897 customer records containing personally identifiable information.
SBI said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure of customer information online.
During the initial assessment, approximately 3.75 lakh records available on the dark web were examined. Of these, 3,897 records were identified as containing personally identifiable information. The bank said further investigation was necessary to establish the authenticity of the exposed data and determine the source and full extent of the incident.
According to reports based on SBI’s regulatory filing, the potentially exposed information included customers’ names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. The records also reportedly contained branch details, Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan-related records and other documents.
The investigation is expected to establish the extent of the exposure and assess the possible risks to affected customers.
Despite the reported data exposure, SBI has stated that the incident has had no material impact on its core business operations, financial performance or business continuity.
The bank said it activated its cyber incident response and containment protocols after receiving the alerts. It has also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the nature and extent of the suspected compromise.
While the investigation continues, customers should remain alert to unexpected calls, emails and messages claiming to be from their bank. Fraudsters may use personal information to make scams appear genuine.
Customers should never disclose their OTP, PIN, internet banking password or other confidential credentials to anyone. They should avoid clicking suspicious links, refrain from installing applications at the request of unknown callers, and verify unusual banking communications through SBI’s official channels.
The incident highlights the growing importance of protecting personal information as cyber threats targeting financial institutions continue to evolve. SBI’s investigation will help establish the authenticity of the records, the extent of the exposure and any further measures required.
