Mumbai: The State Bank of India (SBI) has confirmed that it has individually informed all customers whose personal information was identified in a recent suspected cyber incident, reassuring account holders that their bank balances and funds remain safe. The bank said the affected customers were contacted through email and/or WhatsApp and urged everyone to remain alert to suspicious calls, messages and emails.

The update, issued on October 23, 2026, follows SBI’s disclosure that a preliminary examination of approximately 3.75 lakh records found on the dark web had identified 3,897 customer records containing personally identifiable information. The bank has activated its cyber incident response measures and appointed an independent cybersecurity agency to investigate the incident.

SBI has maintained that the incident has had no material impact on its core banking operations, financial performance or business continuity. However, the investigation is ongoing, and the authenticity, source and full extent of the suspected data exposure are yet to be established.

SBI confirms individual notifications to customers

In its latest public update, SBI said it had directly informed all customers whose data was identified during its preliminary assessment.

The bank communicated the information through email and/or WhatsApp. It also reiterated that customers’ account balances and funds remained safe, seeking to address concerns that the suspected exposure of personal information might mean money had been stolen or accounts accessed.

The bank has advised customers to follow safe digital banking practices and never disclose their one-time passwords (OTPs), personal identification numbers (PINs) or passwords to anyone. It has also urged account holders to exercise caution when receiving unexpected communications.

Customers should remember that scammers may use details such as names, phone numbers or loan-related information to make fraudulent messages appear genuine. A caller who knows a customer’s personal details is not necessarily a legitimate bank representative.

SBI’s notification is therefore an important update, but customers should continue to protect their banking credentials and verify unexpected requests through official bank channels.

What information was identified in the suspected data exposure?

According to SBI’s preliminary findings, 3,897 records containing personally identifiable information were identified among approximately 3.75 lakh records available on the dark web.

The information reportedly included:

  • Customers’ names and registered mobile numbers.
  • Dates of birth and gender details.
  • Email addresses and residential addresses.
  • Bank branch details and Customer Information File (CIF) identifiers.
  • Lead identification numbers and metadata associated with loan and lead records.

The presence of personal information in these records raises concerns about possible misuse, including targeted phishing, impersonation and fraudulent attempts to obtain additional banking credentials.

However, the identification of these records does not by itself establish that every detail was authentic, that all the information was accessed from SBI’s live systems, or that customers’ banking funds were compromised. Determining the authenticity and extent of the data is part of the investigation.

The bank has not publicly identified the source of the suspected exposure. Reports have referred to a hacker group using the name Siriusim, which reportedly claimed to possess a larger collection of SBI-related records. That claim should not be treated as independently verified proof of how the information became available online.

How SBI discovered the incident

SBI said it received alerts about the suspected exposure on October 16, 2026. The alerts came from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

After receiving the information, the bank activated its cyber incident response and containment protocols. It subsequently examined the records available on the dark web as part of its preliminary assessment.

The bank identified 3,897 records containing personal information during this review and began a detailed investigation into the incident. It has also engaged an independent cybersecurity agency empanelled with CERT-In to assess the nature and extent of the suspected breach.

The investigation is expected to help establish whether the identified information is authentic, how it may have been exposed, and what further steps may be required to protect affected customers.

SBI has said that its core banking functions continue to operate normally and that the incident has not materially affected its business operations or financial performance. The bank’s assurances relate to the impact identified so far; the investigation will provide further clarity on the incident itself.

What SBI customers should do now

Although SBI has said that customers’ money remains safe, the suspected exposure of personal information makes vigilance important. Personal details can be used to make fraudulent communications more convincing, even when a criminal does not have direct access to a bank account.

Customers should take the following precautions:

  • Never share OTPs, PINs or passwords. Bank employees should not ask customers to disclose these credentials over a phone call, message or email.
  • Be cautious with links. Avoid clicking unexpected links that claim to verify an account, update KYC details or prevent a banking service from being blocked.
  • Verify the sender. If a message claims to be from SBI, check it through the bank’s official app, website or customer-service channels rather than relying on contact details supplied in the message.
  • Do not install unknown applications. Fraudsters may ask customers to download applications or share their screens under the pretext of resolving a banking issue.
  • Monitor account activity. Review transactions and report any unauthorised activity to the bank promptly.
  • Report suspicious communications. If a caller or message requests confidential information or pressures a customer to act urgently, verify the claim independently before responding.

Customers who receive an email or WhatsApp notification claiming to be from SBI should also ensure that it is genuine. A suspected data exposure can create opportunities for impersonation, and fraudsters may attempt to exploit public concern about the incident.

If customers notice unauthorised transactions, they should contact SBI through its official channels immediately and report suspected financial cyber fraud to the appropriate authorities.

Investigation continues as SBI reassures account holders

SBI’s latest announcement confirms that the bank has notified the customers identified in its preliminary review and continues to maintain that their account balances and funds are safe.

The incident nevertheless highlights the risks associated with the exposure of personal information, even when there is no confirmed indication that bank balances have been affected. Such information can potentially be used in phishing attempts and other forms of social engineering.

The next important development will be the outcome of the independent investigation, which should help clarify the source, authenticity and extent of the suspected data exposure.

For now, SBI customers should remain vigilant, protect their banking credentials and verify unusual requests before acting on them. The bank has reassured account holders about the safety of their funds, while the investigation into the customer information identified online continues.