Mumbai: State Bank of India (SBI), the country’s largest public sector lender, has reported a cybersecurity incident involving the exposure of 3,897 customer records containing personally identifiable information on the dark web. The bank has initiated an investigation with the assistance of an independent cybersecurity agency to determine the source, authenticity and full extent of the data exposure.
The incident came to light after SBI received alerts from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) on October 16, 2026. A preliminary examination of approximately 3.75 lakh records available on the dark web identified 3,897 records containing personal information associated with SBI customers.
According to the bank’s reported disclosure, the exposed information included names, registered mobile numbers, dates of birth, email addresses, residential addresses and customer identification details. Information linked to loan applications and related records was also reportedly present in the dataset.
SBI has stated that the incident is not expected to have a material impact on its core banking operations, financial performance or business continuity. Its investigation is continuing to establish how the information became exposed and what additional measures may be required.
What information was reportedly exposed?
The data exposure is concerning because the information reportedly involved more than basic contact details. Personal identifiers and loan-related records can be misused by criminals attempting to impersonate customers or create convincing fraudulent communications.
The information identified in the preliminary assessment included:
- Customers’ names, registered mobile numbers and dates of birth.
- Email addresses and residential addresses.
- Gender and other personal information.
- Branch identifiers and Customer Information File (CIF) identifiers.
- Lead identification numbers and metadata associated with loan applications and related files.
A CIF number is an identifier banks use to maintain a customer’s information across their banking relationship. Such identifiers, when combined with other personal information, may help fraudsters make their communications appear more credible.
However, the reported exposure of customer records does not automatically mean that banking passwords, PINs, one-time passwords (OTPs) or account balances were compromised. The full scope of the incident remains under investigation, and customers should not assume that every category of banking information has been affected.
The distinction between the number of records examined and the number identified as compromised is also important. SBI’s preliminary assessment examined around 3.75 lakh records found on the dark web and identified 3,897 records containing personally identifiable information associated with its customers. The total dataset should not be interpreted as 3.75 lakh confirmed SBI customer records.
How SBI discovered the incident
SBI reportedly received alerts about the suspected data exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and CERT-In.
The alerts prompted the bank to examine the information circulating on the dark web. During the preliminary analysis, SBI identified the 3,897 customer records and activated its cybersecurity incident response procedures.
The bank has engaged an independent cybersecurity agency empanelled with CERT-In to conduct a forensic assessment. The assessment is intended to establish whether the exposed information is authentic, determine how it was obtained and identify the extent of the compromise.
Investigators will also need to examine the source of the information and determine whether the exposure resulted from unauthorised access, a compromised third-party system, mishandling of data or another security weakness. These are possibilities that require investigation, not confirmed explanations for the incident.
A forensic investigation can help establish the sequence of events, identify any affected systems and recommend measures to prevent similar incidents.
SBI has said it is taking remedial and preventive steps across its information technology infrastructure. The findings of the ongoing assessment will be important in determining whether additional action is needed.
Why dark web data exposure is a serious concern
The dark web refers to parts of the internet that are not ordinarily accessible through standard web browsing and require specialised software or configurations to access. Some dark web services are used for legitimate privacy purposes, but online criminal marketplaces and forums may also circulate stolen information.
When personal data appears in such environments, criminals may attempt to use it for identity theft, targeted phishing, impersonation and other fraudulent activities.
For instance, a fraudster who knows a customer’s name, mobile number, address and loan-related details may send a message claiming to represent the bank. Because the message contains accurate personal information, the recipient may be more likely to trust it.
Fraudsters may also use exposed details to make fraudulent phone calls appear authentic or to persuade customers to reveal additional information. Such attempts can involve fake loan approvals, requests to update know-your-customer (KYC) information or warnings that an account will be blocked unless the customer takes immediate action.
Personal information can remain useful to criminals long after an initial leak. It may be combined with information obtained from other incidents to build more detailed profiles of potential victims.
Nevertheless, the presence of information on the dark web does not prove that it has already been used to commit fraud. The investigation must establish whether the exposed data has been accessed or misused and what risks customers may face.
Does the incident affect SBI’s banking operations?
SBI has stated that the data exposure is not expected to have a material impact on its core business operations, financial performance or business continuity.
This indicates that the bank does not currently anticipate a significant disruption to its main banking activities because of the incident. It does not mean that the data exposure is unimportant or that there is no potential risk to affected customers.
The confidentiality of customer information is a separate concern from the availability of banking services. A bank can continue processing transactions while investigating an incident involving the exposure of personal data.
For customers, the key questions are whether the information is authentic, how many individuals may be affected, whether sensitive financial details were involved and what protective measures are necessary.
The independent assessment should help clarify these questions as more information becomes available.
The incident also highlights the importance of cybersecurity in the banking sector. Financial institutions maintain large volumes of personal and financial information and must protect it across their own systems, external service providers and other connected platforms.
What SBI customers should do now
Customers do not need to panic, but they should be alert to suspicious communications, particularly those that appear to use genuine personal information.
The following precautions can help reduce the risk of fraud:
Do not share OTPs or banking credentials. Never disclose an OTP, ATM PIN, internet banking password, UPI PIN or other authentication details to someone claiming to represent the bank.
Be cautious with unexpected calls and messages. Fraudsters may use names, addresses or loan details to make their requests appear genuine. Verify unusual requests through SBI’s official website, branch or established customer service channels.
Avoid suspicious links. Do not click on links in unexpected messages asking you to update KYC information, unlock an account or claim a loan offer. Access banking services through official channels instead.
Monitor account activity. Check bank statements and transaction alerts for unfamiliar transactions. Contact the bank immediately if you notice anything suspicious.
Secure email and mobile accounts. Use strong, unique passwords where applicable and enable available security protections. Securing the email account associated with banking services can also help reduce the risk of further compromise.
Report suspected financial fraud promptly. In India, people who suspect they have been victims of cyber financial fraud can call the national helpline at 1930 and report the incident through the official National Cyber Crime Reporting Portal at cybercrime.gov.in.
These steps are sensible precautions for banking customers generally. They do not imply that every SBI customer has been affected by this incident.
A wider warning for banking cybersecurity
The SBI incident underscores the importance of protecting customer information throughout its lifecycle, from collection and storage to sharing and eventual deletion.
Banks must maintain strong access controls, monitor unusual activity, review the security of third-party systems and investigate alerts quickly. Regular security assessments and effective incident-response procedures are also important for identifying weaknesses before they lead to wider harm.
The incident further demonstrates why the exposure of personal information can remain a concern even when core banking systems continue operating normally. Criminals may exploit leaked data through social engineering without directly accessing a customer’s bank account.
For SBI, the immediate priority is to establish how the records were exposed, determine whether the dataset contains additional affected customers and implement appropriate corrective measures.
For customers, vigilance remains essential. Accurate personal details in a message or phone call should never be treated as proof that the person contacting them represents the bank.
The investigation will determine the full implications of the reported exposure. Until more details are available, customers should follow official updates, protect their authentication information and report suspicious activity without delay.