SBI Data Exposure: Bank Investigates 3,897 Customer Records Found on Dark Web

The SBI data exposure investigation has brought renewed attention to banking cybersecurity after thousands of customer records were identified in information reportedly circulating on the dark web.

The State Bank of India (SBI), India’s largest public sector bank, is examining a suspected data leak involving 3,897 customer records. The information was identified during an initial assessment of a much larger collection of approximately 3.75 lakh records reportedly available on the dark web.

The suspected exposure includes personal details such as customer names, mobile numbers, dates of birth, email addresses and residential addresses. Certain records also contain banking-related identification numbers and information associated with loan applications and customer leads.

SBI disclosed the development through a regulatory filing with stock exchanges. The bank has initiated a detailed investigation to establish whether the information is genuine, how it may have become accessible and whether the incident has affected customers beyond the records identified so far.

Importantly, SBI has clarified that the suspected data exposure has not disrupted its regular banking services or materially affected its financial performance.

How SBI Discovered the Suspected Customer Data Leak

The matter came to the bank’s attention on October 16, 2026, when SBI received cybersecurity alerts from multiple sources.

These included its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

Following the alerts, the bank examined a collection of approximately 375,000 records reportedly circulating on the dark web. Its preliminary assessment identified 3,897 records containing information classified as personally identifiable information (PII).

The discovery does not mean that all 3.75 lakh records belong to SBI customers. The bank’s initial findings specifically identified 3,897 records containing customer-related personal information within the larger dataset.

The distinction is significant because the complete dataset is still being examined. SBI has not yet established the authenticity or completeness of all the information reportedly available online.

What Information of SBI Customers May Have Been Exposed?

The preliminary findings point to the possible exposure of several categories of personal and customer-related information.

The records reportedly contain:

• Full names and gender of customers.
• Registered mobile numbers.
• Dates of birth.
• Email addresses.
• Residential addresses.
• Bank branch identification details.
• Customer Information File (CIF) identifiers.
• Lead identification numbers.
• Metadata connected with loan applications and customer leads.
• Information contained in other related files.

While this information does not automatically provide access to a customer’s bank account, its exposure could create opportunities for identity-related fraud and targeted financial scams.

For example, fraudsters could potentially use genuine customer details to make fraudulent phone calls or send convincing messages pretending to represent SBI. References to loan-related information could make such communication appear more credible.

However, there is currently no established evidence in the disclosed findings that the suspected exposure has resulted in unauthorised withdrawals or compromised banking credentials.

SBI Appoints Independent Cybersecurity Agency

Rather than relying solely on its initial assessment, SBI has brought in an independent cybersecurity agency to examine the incident in greater detail.

The agency, which is empanelled with CERT-In, has been assigned to investigate the suspected data compromise and establish its actual scope.

The investigation will focus on three important areas: verifying whether the exposed records are authentic, identifying the possible source of the information and determining how much customer data may have been affected.

The assessment will also examine potential security risks arising from the incident and identify additional steps required to protect the bank and its customers.

SBI has confirmed that it activated its cyber incident response and containment procedures after receiving the alerts. It is also evaluating remedial and preventive measures as part of the ongoing response.

The bank has not yet established a complete account of how the information became available on the dark web.

Has the SBI Data Incident Affected Banking Transactions?

For customers concerned about the safety of their deposits and everyday banking activities, SBI’s clarification on operational continuity is important.

The bank has stated that the suspected exposure has not materially affected its core business functions, financial performance or business continuity.

Its regular banking operations continue without disruption.

This means the currently disclosed incident should not be confused with a confirmed shutdown or disruption of SBI’s core banking infrastructure.

There is also an important distinction between customer information being exposed and an unauthorised person gaining control of a bank account. The two situations can involve different security risks and require separate investigation.

Nevertheless, the availability of personal information online can increase the possibility of targeted fraud, making customer awareness particularly important.

Why the Incident Raises Concerns for Banking Customers

Banks maintain extensive customer databases containing personal, financial and identification-related information. Protecting these records is an important part of maintaining trust in digital banking.

A leak involving mobile numbers, addresses and loan-related details can have consequences even when account balances and transaction systems remain secure.

Cybercriminals may combine such information with other publicly available data to create personalised phishing messages, impersonate bank representatives or attempt to obtain confidential banking details.

Customers should be particularly careful about calls claiming that their SBI accounts, debit cards, loans or KYC details require immediate attention.

SBI customers should follow a few basic precautions:

• Never disclose OTPs, ATM PINs, passwords or internet banking credentials.
• Avoid opening suspicious links received through SMS, WhatsApp or email.
• Do not install applications or share screens at the request of unknown callers.
• Verify banking-related communication through SBI’s official website or customer support channels.
• Monitor account statements and report unfamiliar transactions immediately.

Customers who suspect financial cyber fraud can contact the national cybercrime helpline at 1930 or report the incident through the National Cyber Crime Reporting Portal.

Also read | Yogi Adityanath Claims Over 1 Crore Hindu Voters Missing From Uttar Pradesh Electoral Rolls

What Happens Next in the SBI Cybersecurity Investigation?

The immediate priority is to determine the origin and extent of the suspected data exposure.

The independent cybersecurity assessment should help SBI establish whether the identified records are genuine customer information, whether additional records are involved and what security measures may be necessary.

The findings will also be important in determining whether further customer communication or regulatory action is required.

For now, SBI maintains that its banking operations remain stable and that its response measures have been activated. However, the incident highlights a wider challenge facing financial institutions: protecting customer information against increasingly sophisticated cyber threats.

The final picture will become clearer once the detailed investigation establishes how the records reached the dark web and whether the suspected exposure extends beyond the 3,897 records identified in the preliminary assessment.