State Bank of India confirms customer data exposed on the dark web
State Bank of India customer records
State Bank of India (SBI), India's largest bank, disclosed that customer data turned up on the dark web. In a preliminary analysis of about 375,000 records, it identified 3,897 customer records with personal data: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and loan/lead metadata. SBI says balances and funds are safe and core operations are unaffected; the source of the exposure is still under investigation. Affected customers have been notified by email and/or WhatsApp. Expect targeted phishing and fraud calls.
Why this severity: 3,897 customer records with PII identified among ~375,000 leaked records; no impact on funds per SBI
- Started
- Oct 16, 2026
Affected
- 3,897 SBI customer records with PII (preliminary, out of ~375,000 records found on the dark web)
Fixed in
- SBI activated incident response and containment and engaged a CERT-In-empanelled agency; source and full extent still under investigation
Timeline3
SBI says it has individually informed all affected customers by email and/or WhatsApp and reiterates that account balances and funds are safe.
SBI discloses the incident to stock exchanges: 3,897 customer records with PII identified among about 375,000 records, containment activated and an independent CERT-In-empanelled agency engaged.
SBI receives alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In about suspected exposure of customer data on the dark web.
Advisories1
News & write-ups4
- Data breach: SBI admits exposure of its customer data on the Dark WebThe Hindu · Oct 21, 2026
- Data breach: SBI says it individually informed all affected customersThe Hindu · Oct 23, 2026
- Data leak incident: SBI says customer balances completely safeThe Hindu BusinessLine · Oct 23, 2026
- SBI cyber attack update: State Bank of India says customer balance are completely safe despite data leakThe Economic Times · Oct 21, 2026
Notes & caveats
Figures are from SBI's preliminary analysis; how the data was exposed has not been disclosed.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
