State Bank of India Reports Suspected Customer Data Exposure on Dark Web

State Bank of India (SBI), the country's largest lender, announced on Wednesday that it experienced an incident involving the suspected exposure of customer data on the dark web.

According to an exchange filing by the bank, a preliminary analysis of approximately 3,75,000 records available on the dark web identified 3,897 customer records containing Personally Identifiable Information (PII).

The exposed information reportedly includes customers' names, dates of birth, gender, registered mobile numbers, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan and lead records.

The disclosure follows communications received by the bank on October 16, 2026, from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In.

In response to the incident, SBI stated that it promptly activated its cyber incident response and containment protocols. The bank also engaged an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise.

The bank noted that a detailed investigation is required to establish the authenticity and completeness of the exposed data, identify the potential source and extent of the exposure, and evaluate the associated risks to both customers and the institution.

Despite the incident, SBI assured stakeholders that the event does not have any material impact on its core business operations, financial performance, or business continuity. The bank confirmed that its core business functions continue to operate normally without disruptions.

A detailed assessment is currently underway, and appropriate remedial and preventive measures are being implemented as required. SBI added that it continues to monitor the situation closely and will take all necessary measures in accordance with applicable regulatory requirements.

"Data security and incident transparency are critical priorities for financial institutions operating in the digital economy. While the bank has confirmed that core operations remain unaffected and containment protocols have been activated, incidents of this nature highlight the constant need for robust cybersecurity measures, rigorous vendor risk management, and continuous threat monitoring to safeguard sensitive customer information." — Dr. Shishir Gupta, Founder & CEO, StartupLanes