The State Bank of India (SBI) is investigating a suspected data leak after a preliminary analysis of approximately 3.75 lakh records found on the dark web identified 3,897 records containing personally identifiable information (PII). The bank received alerts about the suspected exposure on October 16, 2026, and disclosed the findings on October 21.
The dataset was reportedly found on the dark web, where stolen or leaked information is sometimes shared or sold. A threat actor using the name Siriusim reportedly claimed access to approximately 3.75 lakh SBI customer records and 2,722 PDF documents, but these claims remain unverified. SBI has launched a cybersecurity investigation to determine the source and extent of the suspected exposure.
SBI stated that the incident has no material impact on its core operations, financial performance, or business continuity.
What Happened in the SBI Data Breach?
SBI received alerts on October 16, 2026, from its threat-intelligence service provider, the Defence Cyber Agency, and CERT- In about suspected customer data exposure on the dark web.
A preliminary analysis of approximately 3.75 lakh records identified 3,897 records containing personally identifiable information (PII).
The group Siriusim reportedly claimed access to SBI-linked data and 2,722 PDF documents. However, the claims about the data’s authenticity, source, and completeness remain unverified.
SBI launched a cybersecurity investigation to verify the data, determine the extent of the exposure, and assess potential risks to customers.
What SBI Customer Information Was Reportedly Exposed?
According to SBI’s preliminary analysis, the identified records contained personally identifiable information (PII) and other customer-related details, reportedly including:
- Personal details: Customer names, gender, and dates of birth.
- Contact information: Registered mobile numbers, email addresses, and residential addresses.
- Banking identifiers: Branch details and Customer Information File (CIF) identifiers.
- Loan-related information: Lead IDs and metadata associated with loan and lead records.
If authentic, this information could be misused for targeted phishing, impersonation, and identity fraud. Fraudsters may use personal details to make calls, emails or messages appear more credible.
The available reporting does not establish whether account passwords, UPI PINs or other banking authentication credentials were exposed. The investigation is ongoing, and customers should not assume either that these credentials were compromised or that they are guaranteed to be unaffected.
How Has SBI Responded to the Suspected Data Leak?
SBI has activated its cyber incident response protocols and engaged an independent cybersecurity agency empanelled with CERT-In to investigate the suspected data exposure.
The investigation will verify the data’s authenticity, identify the potential source, and assess the risks. SBI will take remedial and preventive measures as required.
The bank stated that the incident has not materially affected its core operations, financial performance, or business continuity.
How Can SBI Customers Protect Themselves?
While SBI’s investigation continues, customers should take precautions against phishing attempts and other potential fraud:
- Never share OTPs or PINs: Do not disclose OTPs, UPI PINs, or NetBanking passwords to callers claiming to represent SBI.
- Watch for targeted scams: Be cautious of calls or messages that use personal or loan-related details to create urgency.
- Verify unexpected requests: Contact SBI through its official website, app, or verified customer-service channels before taking action.
- Avoid suspicious links: Do not click unverified links or install applications at the request of unknown callers.
- Monitor transactions: Check account activity regularly and report unauthorised transactions to SBI immediately.
- Report cyber fraud: If you experience financial cyber fraud in India, call 1930 and report it through the National Cyber Crime Reporting Portal at cybercrime.gov.in.
These precautions can help reduce fraud risks. The reported incident does not, by itself, establish that every SBI customer or account has been affected.
Frequently Asked Questions
- How many SBI customer records were identified in the suspected data breach?
SBI’s preliminary analysis identified 3,897 records containing personally identifiable information (PII) among approximately 3.75 lakh records found on the dark web.
- Did hackers access SBI customer accounts?
This has not been established. The 3.75 lakh figure refers to the larger dataset examined by SBI, not verified compromised customer accounts. The investigation is ongoing.
- How can SBI customers protect themselves from potential fraud?
Customers should never share OTPs, UPI PINs, or banking passwords. They should avoid suspicious links, verify unexpected requests through official SBI channels, monitor account activity, and report suspected financial cyber fraud by calling 1930 in India.
