SBI Reports Suspected Customer Data Leak on Dark Web, Assures Balances Are Safe

State Bank of India (SBI) announced on Friday that a recent cyber incident involving a data leak has impacted a very small number of customers. The country's largest bank assured the public that customer balances remain completely safe and that the incident does not have any material impact on its IT and core business operations, financial performance, or business continuity.

The disclosure follows an incident on October 21st, when SBI reported a suspected exposure of customer data on the dark web. According to the bank's exchange filing, a preliminary analysis of approximately 3,75,000 records found on the dark web identified 3,897 customer records containing Personally Identifiable Information (PII).

The exposed information reportedly includes registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan or lead records and other related files. The bank stated that safety of its customers' financial assets, data, and their trust remain its highest priorities.

Following the discovery, SBI activated its cyber incident response and containment protocols. An independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise.

The sequence of events began after the bank received communications on October 16, 2026, from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In. SBI noted that a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.

A detailed assessment is currently underway, and appropriate remedial and preventive measures are being implemented as required. The bank stated that it continues to monitor the situation closely and will take all appropriate measures in accordance with applicable regulatory requirements to protect the interests of its customers.

"Incidents of this nature highlight the critical need for robust cybersecurity measures across all financial institutions, regardless of their scale. While SBI has acted promptly by engaging CERT-In empanelled agencies and confirming that core balances are safe, this serves as a reminder for businesses handling sensitive Personally Identifiable Information to continuously strengthen threat intelligence, monitoring systems, and containment protocols to protect customer trust." — Dr. Shishir Gupta, Founder & CEO, StartupLanes