SBI customer data leak: CPI-M MP seeks independent probe, writes to Sitharaman
Synopsis
A CPI-M MP has written to Finance Minister Nirmala Sitharaman demanding an independent investigation into the reported exposure of 3,897 SBI customer records on the dark web — including names, mobile numbers, dates of birth, and loan metadata. The SBI says its operations are unaffected, but the letter puts a spotlight on whether public sector banks are doing enough to protect customer data even when core banking systems stay up.
Key Takeaways
CPI-M Rajya Sabha MP A.A.
Rahim wrote to Finance Minister Nirmala Sitharaman on 22 October 2026 seeking an independent cybersecurity probe into SBI .
Approximately 3,897 SBI customer records were reportedly identified circulating on the dark web, containing names, mobile numbers, dates of birth, and loan metadata.
SBI received alerts on 16 October from its threat intelligence provider, the Defence Cyber Agency , and CERT-In .
An independent cybersecurity agency has been engaged; the source and full extent of the breach remain under investigation.
Rahim called for direct notification of affected customers, transparent disclosure of findings, and a system-wide cybersecurity review of all public sector banks.
SBI has said its core operations and business continuity have not been materially affected.
Communist Party of India (Marxist) Rajya Sabha member A.A. Rahim on 22 October 2026 wrote to Union Finance Minister Nirmala Sitharaman, demanding an independent investigation into the reported exposure of State Bank of India (SBI) customer data on the dark web. The intervention raises serious questions about the cybersecurity posture of India's largest public sector bank and its obligations to millions of account holders.
What Was Reportedly Exposed
According to reports, SBI identified approximately 3,897 customer records containing personally identifiable information circulating on the dark web. The data allegedly includes customers' names, registered mobile numbers, dates of birth, email and residential addresses, branch details, Customer Information File (CIF) identifiers, and metadata linked to loan and lead records.
The bank reportedly received alerts about the suspected exposure on 16 October from its threat intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). An independent cybersecurity agency has since been engaged to investigate the incident.
What Rahim Has Demanded
In his letter to the Finance Ministry, Rahim urged authorities to establish the source and full extent of the suspected breach, directly notify all affected customers, and set clear timelines for the investigation. He also called for transparent public disclosure of findings and the corrective steps taken.
The Communist Party of India (Marxist) MP stressed that accessible channels must be created for customers to report suspected fraud and seek assistance. He further asked the Finance Ministry to fix accountability wherever negligence or security lapses are confirmed.
Who Is at Risk
Rahim warned that the compromised data, if misused, could expose ordinary customers to identity theft, targeted phishing, impersonation, and financial fraud. He specifically flagged the vulnerability of pensioners, workers, and small traders — groups that may be less equipped to detect or respond to such threats.
Notably, the CPI-M MP argued that the absence of any disruption to banking services does not diminish the gravity of the suspected personal data compromise — a distinction that often goes unacknowledged in institutional responses to such incidents.
SBI's Position
The SBI has maintained that the incident has not materially affected its core operations or business continuity. However, the bank has not publicly disclosed whether affected customers have been individually informed. The full extent and origin of the suspected exposure remain under active investigation.
Broader Implications for Public Sector Banks
Rahim extended his demand beyond the SBI, urging the Finance Ministry to conduct a comprehensive review of cybersecurity safeguards across all public sector banks. He called for strengthened real-time threat detection systems and tighter data-access controls, arguing that the current incident reflects a systemic gap rather than an isolated lapse.
This comes amid a broader global pattern of financial institutions facing dark web data exposure, and as India advances its digital banking infrastructure at scale. The outcome of the independent investigation is expected to shape how public sector banks approach customer data protection going forward.
Point of View
Not a systems outage, and the benchmark should be whether customers' personal information has been secured, not whether ATMs are running. The 3,897-record figure may sound modest against SBI's half-a-billion-customer base, but CIF identifiers and loan metadata in combination are high-value inputs for targeted fraud, not just nuisance spam. What is missing from the public response so far is any commitment to proactively notify affected customers — a standard that regulators in the EU and US have made mandatory. Rahim's letter is politically timed, but the substance is legitimate: India's public sector banks are digitising at pace while their cybersecurity governance frameworks lag well behind. If CERT-In and the Defence Cyber Agency had to alert SBI before the bank detected the exposure itself, that is the real accountability question the Finance Ministry should answer.
NationPress
22 Oct 2026
Frequently Asked Questions
What is the SBI dark web data exposure about?
It refers to the reported appearance of approximately 3,897 SBI customer records on the dark web, containing personally identifiable information such as names, mobile numbers, dates of birth, email and residential addresses, CIF identifiers, and loan-related metadata. SBI was alerted to the suspected exposure on 16 October by CERT-In, the Defence Cyber Agency, and its own threat intelligence provider.
Why has CPI-M MP A.A. Rahim written to Finance Minister Sitharaman?
Rahim has urged the Finance Ministry to order an independent investigation to establish the source and extent of the breach, ensure affected customers are directly notified, and fix accountability for any negligence. He also wants a broader review of cybersecurity safeguards across all public sector banks, not just SBI.
Has SBI confirmed the data breach?
SBI has acknowledged receiving alerts about suspected data exposure and has engaged an independent cybersecurity agency to investigate. However, the bank has stated that the incident has not materially affected its core operations or business continuity. The full extent and source of the exposure remain under investigation.
Who are the most at-risk customers?
According to Rahim, pensioners, workers, small traders, and other vulnerable groups face elevated risk because the compromised data — including names, dates of birth, and mobile numbers — can be used for identity theft, phishing, impersonation, and financial fraud. These groups may be less equipped to identify or respond to such threats.
What happens next in the investigation?
An independent cybersecurity agency is currently investigating the incident. Rahim has demanded clear timelines, transparent disclosure of findings, and corrective measures. It is not yet known when results will be made public or whether the Finance Ministry will act on his request for a system-wide review of public sector bank cybersecurity.
