SBI data breach: 3,897 customer records exposed, funds safe says bank
Synopsis
India's largest bank confirmed that 3,897 customer records — including names, mobile numbers, addresses, and loan metadata — were found on the dark web after a cyber incident. SBI says funds are untouched and has individually notified affected customers, but with a pool of 3,75,000 records in play, the full scope of exposure is still under investigation.
Key Takeaways
SBI confirmed a cyber incident exposed 3,897 customer records on the dark web, out of approximately 3,75,000 records analysed.
Exposed data reportedly includes names, mobile numbers, dates of birth, email and residential addresses, CIF identifiers , and loan-related metadata.
The bank asserts that account balances and funds are safe and unaffected by the breach.
Alerts were received from SBI's Threat Intelligence Service Provider , the Defence Cyber Agency , and CERT-In .
A CERT-In-empanelled cybersecurity agency has been engaged for a comprehensive investigation, which is currently ongoing.
All 3,897 affected customers have been individually notified via email and/or WhatsApp.
State Bank of India (SBI), the country's largest lender, has assured customers that their account balances and funds remain unaffected following a cyber incident that led to the exposure of 3,897 customer records on the dark web. The bank made the clarification on Friday, 23 October 2026, days after confirming the breach through an exchange filing.
What SBI Said
In a statement shared on social media platform X, SBI said: 'Further to our earlier post regarding the recent cyber incident, the lender has individually informed all customers whose data was identified as being involved through email and/or WhatsApp. We reiterate that your account balances and funds are safe with us.'
The bank also urged customers to follow safe digital banking practices — never share OTPs, PINs, or passwords with anyone — and to stay alert against suspicious calls, messages, and emails.
How the Breach Was Discovered
SBI disclosed earlier this week that it had received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding suspected exposure of customer data. During a preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified.
The exposed data reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan or lead records and related files.
Response and Investigation
Upon detecting the exposure, SBI said it promptly activated its cyber incident response and containment protocols. The bank engaged an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise.
A detailed investigation is currently underway to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess associated risks, according to the bank's statement.
What This Means for Customers
While SBI has stressed that financial assets are secure, the breach involves sensitive personal identifiers that could potentially be misused for phishing, social engineering, or identity fraud. This comes amid a broader surge in cyberattacks targeting Indian financial institutions, with CERT-In having flagged multiple incidents affecting banking infrastructure in recent months.
Notably, the scale of the initial dataset — 3,75,000 records — on the dark web suggests a wider data pool was accessed, though the bank has confirmed only 3,897 records as belonging to its customers. The investigation's outcome will determine whether that number rises.
All affected customers are being contacted individually, and the bank's cybersecurity probe is expected to yield further findings in the coming days.
Point of View
SIM-swap attacks, and social engineering enabled by precisely the kind of PII now reportedly in circulation. The real concern is the gap between the 3,75,000-record dark web dataset and the 3,897 confirmed SBI records — an investigation that is 'underway' is not the same as an investigation that is complete. Indian banks have repeatedly faced criticism for delayed disclosure and narrow framing of breach impact. Whether SBI's response clears that bar will depend on what the CERT-In-empanelled probe concludes — and whether those findings are made public.
NationPress
23 Oct 2026
Frequently Asked Questions
What happened in the SBI data breach?
SBI experienced a cyber incident in which 3,897 customer records containing Personally Identifiable Information were found exposed on the dark web. The bank was alerted by its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In, and has since activated its incident response protocols.
Are SBI customer account balances and funds at risk?
SBI has categorically stated that account balances and funds remain safe and unaffected by the breach. However, customers are advised to stay vigilant against phishing attempts and never share OTPs, PINs, or passwords with anyone.
What personal data was exposed in the SBI breach?
The exposed records reportedly include customers' registered mobile numbers, names, dates of birth, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan or lead records. The bank has not confirmed every data field as verified.
How is SBI responding to the data breach?
SBI has activated its cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to investigate. All 3,897 affected customers have been individually notified via email and/or WhatsApp.
How many SBI customer records were found on the dark web?
During preliminary analysis of approximately 3,75,000 records available on the dark web, SBI identified 3,897 records as belonging to its customers. A detailed investigation is ongoing to determine the full extent of the exposure.
