SBI Bank Notifies Customers of Data Breach

Key Takeaways

• State Bank of India (SBI) has initiated direct notifications to customers impacted by a recent cyber incident.
• The breach involves the suspected exposure of personal information, including names, mobile numbers, and addresses, found on the dark web.
• Approximately 3,897 customer records containing personally identifiable information have been confirmed as exposed after a review of 375,000 dark web records.
• SBI assures customers that account balances and funds remain secure, with no material impact on core banking operations.
• Customers are advised to remain vigilant against phishing attempts and verify all communications through official bank channels.

SBI Informs Customers of Data Exposure Incident

The State Bank of India (SBI) has begun individually alerting customers whose personal data was identified in a recent cyber incident. These notifications are being delivered via email and WhatsApp, marking a shift from general public disclosures to targeted communication.

In an advisory issued on October 23, 2026, the bank reassured its clientele that their account balances and funds are secure. This assurance comes as the bank continues its investigation into the suspected exposure of customer information discovered on the dark web.

Details of the Compromise

The bank’s preliminary analysis involved scrutinizing approximately 375,000 records found on the dark web. From this extensive review, SBI confirmed that 3,897 customer records contained personally identifiable information (PII). It is important to note that the larger figure represents the total records examined, not the confirmed number of affected SBI customers or compromised bank accounts.

The exposed data reportedly includes sensitive details such as customer names, registered mobile numbers, dates of birth, email addresses, and home addresses. Additional fields compromised include gender, branch details, Customer Information File (CIF) identifiers, and information related to loan inquiries and lead records. Such comprehensive details could potentially allow malicious actors to identify customers and gain insights into their banking relationships.

Incident Response and Investigation

The incident came to SBI’s attention on October 16, following alerts from its threat intelligence service provider, the Defense Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). In response, the bank activated its incident response and containment protocols, concurrently engaging an independent cybersecurity agency, impaneled with CERT-In, to lead the investigation.

Investigators are currently focused on verifying the authenticity, pinpointing the source, and determining the full extent of the exposed information. SBI has said that, to date, the incident has had no material impact on its core operations, financial performance, or business continuity, with banking services remaining uninterrupted.

It is crucial to distinguish these confirmed findings from earlier unverified claims regarding an SBI data breach that alleged customer records and banking documents were posted online. The ongoing investigation will clarify the precise nature and scope of the compromise.

Risk Assessment and Customer Guidance

While personal data exposure does not automatically equate to account takeover, the presence of contact and loan details could enable cybercriminals to craft highly convincing phishing messages that appear legitimate. The current reporting does not indicate that passwords, PINs, OTPs, or transaction credentials were compromised.

Customers should exercise extreme caution with any unexpected communications. They are advised to verify the authenticity of notifications through official banking channels rather than relying on messages that contain accurate personal details. Avoiding unfamiliar links and regularly reviewing bank statements for unauthorized transactions are critical preventative measures.

What You Should Do

• Be Skeptical of Unsolicited Communications: Always verify unexpected calls, messages, or emails claiming to be from SBI through official bank contact numbers or secure online portals.
• Never Share Sensitive Information: SBI will never ask for your password, PIN, or one-time password (OTP) via phone, email, or message. Do not disclose these credentials to anyone.
• Monitor Account Activity: Regularly review your bank statements for any unauthorized transactions or suspicious activity. Report any discrepancies immediately.
• Report Suspicious Activity: If you receive a suspicious email or message, or suspect a cyber incident, report it to [email protected] or contact India’s cybercrime helpline at 1930.
• Use Strong, Unique Passwords: Ensure your online banking password is strong and unique, and consider enabling multi-factor authentication if available.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.