The State Bank of India (SBI) is investigating a suspected data leak after personal information linked to 3,897 customers was identified in a dataset found on the dark web. The country’s largest public sector lender disclosed the incident in a filing to stock exchanges on October 21, 2026, following alerts from cybersecurity agencies. A preliminary examination of approximately 3.75 lakh records available online identified entries containing personally identifiable information. The incident has raised concerns about the privacy of banking customers and the potential misuse of their personal details by cybercriminals.
According to SBI, the exposed information includes customers’ names, gender, registered mobile numbers, dates of birth, email addresses and residential addresses. The records also reportedly contain branch details, Customer Information File identifiers, lead IDs and metadata associated with loan applications and related records. The bank received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). Following these alerts, SBI activated its cyber incident response and containment procedures.
The bank has appointed an independent cybersecurity agency empanelled with CERT-In to investigate the incident and establish the nature and extent of the suspected compromise. Investigators are examining the authenticity and completeness of the exposed records, the possible source of the information and the risks to customers. SBI has not yet established publicly where the data originated or how it may have been accessed. The investigation is expected to help determine whether the exposure resulted from the bank’s systems, a third-party service provider or another source.
Also Read: Navy Sailor Arrested In Coimbatore Over Alleged Classified Data Leak To Pakistani Operative
SBI has stated that the incident has not had any material impact on its core business operations, financial performance or business continuity. Its banking services continue to function normally, and the bank said it was implementing appropriate remedial and preventive measures. The exposure of personal information does not necessarily mean that customers’ bank accounts have been accessed or that money has been stolen. The preliminary findings do not establish that passwords, PINs or account credentials were compromised, and the full extent of the incident remains under investigation.
However, cybersecurity experts warn that leaked personal details can be used to conduct targeted phishing attacks and financial scams. Fraudsters may use a customer’s name, phone number, address or loan-related information to impersonate bank employees and persuade victims to disclose confidential information. Customers should avoid sharing one-time passwords, PINs or banking passwords over phone calls or messages, even when the person contacting them appears to know their personal details. Suspicious requests should be verified independently through SBI’s official customer service channels.
The incident comes amid growing concerns about cybersecurity threats targeting India’s banking and financial sectors. While SBI continues to assess the suspected exposure, the investigation will be crucial in establishing the source of the data and determining whether additional security measures are required. Customers should remain vigilant against unsolicited calls, suspicious links and requests to install unfamiliar applications. Further details are expected as the bank’s cybersecurity assessment progresses and authorities work to establish the full circumstances surrounding the suspected data leak.
Also Read: Bangladeshi Migrant Worker Nazrul Islam Executed in Saudi Arabia