The State Bank of India (SBI) has acknowledged a data breach incident involving over 3,000 customer records found on the dark web. The revelation came through an official filing to the stock exchange on October 21, 2026. The bank is currently working to verify the authenticity and origin of the leaked data.
Details of the Data Exposure
According to SBI, the breach notification was triggered by alerts from the Defense Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) on October 16. These alerts pointed to the possible exposure of sensitive customer information on the dark web. Following the alerts, SBI conducted a review of approximately 375,000 records, identifying 3,897 as containing personal information.
The compromised data includes personal identifiers such as mobile numbers, birth dates, names, gender, email addresses, and home addresses. Additionally, details such as branch identifiers and metadata related to loan records were also reportedly exposed. Despite this, the bank assured that no passwords, PINs, or one-time passwords were among the leaked information, and there have been no reports of stolen funds.
SBI’s Response and Investigation
In response to the breach, SBI swiftly enacted its incident response plan, enlisting the help of an independent cybersecurity agency approved by CERT-In. The investigation aims to verify the data’s authenticity, determine the extent of the breach, and assess potential risks to customers and the bank. The bank is also implementing necessary preventive measures.
No specific details regarding the entry point, vulnerabilities exploited, or the identity of the attackers have been disclosed. This lack of information makes it difficult to attribute the incident to any particular method such as ransomware or phishing attacks.
Customer Advisory and Security Measures
SBI has advised its customers to remain vigilant for phishing attempts, as such attacks often follow data breaches. CERT-In has issued warnings about fraudulent activities involving fake bank communications and urgent account alerts. Customers are urged to verify messages through official channels, avoid unrecognized links, and refrain from sharing sensitive information like PINs or one-time passwords.
As the investigation continues, SBI remains committed to monitoring the situation closely and taking appropriate regulatory actions. Further findings will be essential to fully understand the breach’s scope and origin.
Banking security remains a critical concern, and incidents like this underscore the importance of robust cybersecurity measures to protect customer information.
