SBI Confirms Data Breach Exposing 3,000+ Customer Records on Dark Web

Key Takeaways

• State Bank of India (SBI) has confirmed a data loss incident affecting 3,897 customer records.
• Exposed data includes personally identifiable information (PII) such as names, mobile numbers, dates of birth, email, and addresses, along with banking metadata.
• The bank’s core systems remain operational, with no reported impact on financial performance or business continuity.
• The source and full extent of the data compromise are still under investigation, with an independent cybersecurity agency engaged.

State Bank of India (SBI) has publicly acknowledged a data loss event following an initial assessment that identified 3,897 customer records circulating on the dark web. The bank formally disclosed these findings in a stock exchange filing dated October 21, 2026, emphasizing that ongoing investigations are crucial to verify the data’s authenticity, completeness, and origin.

This disclosure confirms the data loss incident but does not specify the method by which the information was acquired, nor does it confirm a direct breach of SBI’s core banking infrastructure. The institution affirmed that its services continue without disruption, reporting no significant impact on its primary operations, financial stability, or business continuity.

SBI Confirms Data Exposure

SBI reported receiving alerts on October 16 from various entities, including its threat intelligence provider, the Defense Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). These notifications highlighted the suspected exposure of customer information within dark web channels.

Investigators meticulously reviewed an extensive dataset of approximately 375,000 records, ultimately confirming that 3,897 of these contained personally identifiable information (PII). It is important to note that the larger figure of 375,000 records should not be misconstrued as the number of confirmed victims, as record counts often include duplicate entries and do not always represent unique individuals.

The compromised information reportedly encompasses registered mobile numbers, dates of birth, full names, gender, email addresses, and residential addresses. Additionally, SBI identified exposure of branch and customer information file (CIF) identifiers, lead IDs, and associated metadata pertaining to loan records, lead records, and related files.

The nature of these exposed fields extends beyond simple contact details. The inclusion of branch specifics and loan references could potentially enable threat actors to craft highly convincing fraudulent banking communications. However, the official filing explicitly states that passwords, PINs, or one-time passwords were not among the exposed data, and there have been no reports of financial theft directly linked to this incident.

Previous reporting by Cyber Security News detailed a separate claim regarding an SBI data breach involving an actor known as “Siriusim,” which cited 375,000 CSV rows and 2,722 PDF files. These earlier allegations remain distinct from the findings SBI has now disclosed, as the bank’s current report refrains from attributing the incident to any named attacker.

In response to the cyber incident, SBI promptly activated its established response and containment protocols. The bank has also engaged an independent cybersecurity firm, approved by CERT-In, to conduct a thorough evaluation of the situation and ascertain the full scope of the suspected breach.

The ongoing investigation aims to verify the authenticity and completeness of the data, pinpoint its potential origin, determine the scale of the exposure, and assess the risks posed to both customers and the bank itself. SBI has indicated that necessary remedial and preventive measures are being implemented.

Crucially, the filing does not identify a specific entry point, an exploited vulnerability, a particular malware family, or any compromised servers. Consequently, there is currently no basis to attribute this incident to ransomware, phishing attacks, or any specific software flaw.

While a separate report detailed unauthorized access to an employee email account at Bank of Baroda, offering context on banking security challenges, there is no established connection or shared attack methodology with the current SBI incident.

For customers, the primary concern stemming from this incident is the potential for targeted phishing attempts, rather than a confirmed direct consequence. CERT-In’s online scam advisory consistently warns that cybercriminals leverage deceptive tactics, such as fake bank messages, urgent account warnings, and requests for personal information, to defraud users.

What You Should Do

• Always verify the legitimacy of unexpected messages or calls purporting to be from your bank by contacting them directly through official channels, not via links or numbers provided in the suspicious communication.
• Exercise extreme caution with unfamiliar links in emails or SMS messages, even if they appear to be from a trusted source.
• Never share your PINs, passwords, or one-time passwords (OTPs) with anyone, regardless of who they claim to be.
• Regularly review your bank statements and transaction history for any unauthorized or suspicious activity.
• Consider enabling multi-factor authentication (MFA) on all your online banking and sensitive accounts where available.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.