# State Bank of India confirms customer data exposed on the dark web · pwn.watch > State Bank of India (SBI), India's largest bank, disclosed that customer data turned up on the dark web. In a preliminary analysis of about 375,000 records, it identified 3,897 customer records with personal data: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and loan/lead metadata. SBI says balances and funds are safe and core operations are unaffected; the source of the exposure is still under investigation. Affected customers have been notified by email and/or WhatsApp. Expect targeted phishing and fraud calls. Page: https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026 · generated 2026-10-23T13:44:18.354Z ## Status - Severity: medium · status: live · patch: partial - Product: State Bank of India customer records - Started: 2026-10-16 - Affected: 3,897 SBI customer records with PII (preliminary, out of ~375,000 records found on the dark web) - Fixed in: SBI activated incident response and containment and engaged a CERT-In-empanelled agency; source and full extent still under investigation ## Follow this incident - RSS (one item per update): https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026.json - This file: https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026/llms.txt ## Updates (newest first) - 2026-10-23: SBI says it has individually informed all affected customers by email and/or WhatsApp and reiterates that account balances and funds are safe. (https://www.thehindu.com/business/Industry/data-breach-sbi-says-it-individually-informed-all-affected-customers/article71615008.ece) - 2026-10-21: SBI discloses the incident to stock exchanges: 3,897 customer records with PII identified among about 375,000 records, containment activated and an independent CERT-In-empanelled agency engaged. (https://nsearchives.nseindia.com/corporate/SBIN_21102026084938_BSE_NSE_21102026.pdf) - 2026-10-16: SBI receives alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In about suspected exposure of customer data on the dark web. (https://nsearchives.nseindia.com/corporate/SBIN_21102026084938_BSE_NSE_21102026.pdf) ## Fix brief # Security brief: State Bank of India confirms customer data exposed on the dark web Source: https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026 · status: live · severity: medium · updated Oct 23, 2026, 13:43 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is State Bank of India (SBI), India's largest bank, disclosed that customer data turned up on the dark web. In a preliminary analysis of about 375,000 records, it identified 3,897 customer records with personal data: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and loan/lead metadata. SBI says balances and funds are safe and core operations are unaffected; the source of the exposure is still under investigation. Affected customers have been notified by email and/or WhatsApp. Expect targeted phishing and fraud calls. Severity detail: 3,897 customer records with PII identified among ~375,000 leaked records; no impact on funds per SBI - Product: State Bank of India customer records ## Affected versions - 3,897 SBI customer records with PII (preliminary, out of ~375,000 records found on the dark web) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - SBI activated incident response and containment and engaged a CERT-In-empanelled agency; source and full extent still under investigation After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Latest updates - Oct 23, 2026: SBI says it has individually informed all affected customers by email and/or WhatsApp and reiterates that account balances and funds are safe. - Oct 21, 2026: SBI discloses the incident to stock exchanges: 3,897 customer records with PII identified among about 375,000 records, containment activated and an independent CERT-In-empanelled agency engaged. - Oct 16, 2026: SBI receives alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In about suspected exposure of customer data on the dark web. ## Advisories - [Disclosure under Regulation 30 of SEBI (LODR): Incident involving Data Loss (PDF)](https://nsearchives.nseindia.com/corporate/SBIN_21102026084938_BSE_NSE_21102026.pdf) (State Bank of India via NSE) ## Write-ups & news - [Data breach: SBI admits exposure of its customer data on the Dark Web](https://www.thehindu.com/business/Economy/state-bank-of-india-investigates-exposure-customer-records-dark-web-october-21/article71606599.ece) - [Data breach: SBI says it individually informed all affected customers](https://www.thehindu.com/business/Industry/data-breach-sbi-says-it-individually-informed-all-affected-customers/article71615008.ece) - [Data leak incident: SBI says customer balances completely safe](https://www.thehindubusinessline.com/money-and-banking/data-leak-incident-sbi-says-customer-balances-completely-safe/article71615271.ece) - [SBI cyber attack update: State Bank of India says customer balance are completely safe despite data leak](https://economictimes.indiatimes.com/wealth/save/sbi-cyber-attack-update-state-bank-of-india-says-customer-balance-are-completely-safe-despite-data-leak/articleshow/135091172.cms) ## Caveats Figures are from SBI's preliminary analysis; how the data was exposed has not been disclosed. --- Machine-readable: https://pwn.watch/i/state-bank-of-india-dark-web-data-leak-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.