Short answer
On October 21, 2026, State Bank of India told stock exchanges it was alerted, including by CERT-In, to suspected customer data on the dark web. A preliminary review found 3,897 customer records. SBI says it has not yet verified the data's authenticity or source.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | State Bank of India (SBI) |
|---|---|
| Incident type | Data leak |
| Status | Under investigation |
| Sector | Banking |
| Country | India |
| Detected | 2026-10-16 |
| Disclosed | 2026-10-21 |
| People or records affected | 3,897 customer records identified by SBI in a preliminary review of about 375,000 records found on the dark web |
What data was exposed
- Names, registered mobile numbers, dates of birth and gender
- Email addresses and residential addresses
- Branch and customer information file (CIF) identifiers, lead IDs, and metadata linked to loan and lead records
What happened
On October 21, 2026, State Bank of India filed a notice titled “Incident involving Data Loss” with the BSE and NSE under SEBI disclosure rules. The bank said it received alerts of suspected customer data exposure on the dark web from three sources: its threat intelligence vendor, the Defence Cyber Agency, and CERT-In, India’s national cyber emergency team. The Internet Freedom Foundation (IFF), which read the filing, dates those alerts to October 16.
Who said what
This story has several layers of claims, so we separate them.
SBI’s filing. A preliminary analysis of about 3.75 lakh records on the dark web found 3,897 customer records containing personal information, The Week reports. The bank described it as an “incident involving the loss of certain data” and, per The Hacker News, named no cause. It said it has not verified whether the data is authentic or complete, where it came from, or how far the exposure goes. It activated its incident response protocol and hired an independent agency empanelled by CERT-In. It said the incident has no material impact on core operations or financial performance.
A threat actor’s claim. The IFF says a threat actor calling itself “Siriusim” claimed on October 16 to have released the data, per the monitoring account CyberPulse56. The same actor reportedly claimed 2,722 PDF documents, including loan applications and account opening forms. SBI’s filing does not address those PDFs. The Hacker News, citing the Free Press Journal, says a BreachForums listing had four sample records whose phone numbers were valid. That checks only four records. We treat the claims as unverified.
Authorities. We found no public CERT-In statement of its own. What we know about its role comes from SBI’s filing. Reporting dates also vary: some outlets say SBI went public on October 21, others October 22.
What is exposed
The fields reported in the 3,897 records are names, registered mobile numbers, dates of birth, gender, email and residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan and lead records. The filing does not say whether Aadhaar, PAN or passport copies are included. The IFF has asked SBI that exact question.
What is still unknown
SBI has not said whether affected customers will be told directly. In a representation to SBI’s chairman, copied to the RBI governor and CERT-In, the IFF asked for SMS, email and letter notices, a helpline, a way to check exposure, and an explanation of how the data left the bank, including any vendor or agent involvement. The bank has not publicly answered those points in anything we reviewed.
Protecting yourself
Leaked names, birth dates and loan details make fraud calls convincing. Our guide to phishing messages covers fake KYC links, and urgent payment scams explains the pressure tactics used in “your account will be blocked” calls. What to do after a data breach lists the follow-up steps. See other incidents in our breach archive.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake KYC update calls, SMS or WhatsApp messages from 'SBI' asking you to click a link or install an app to avoid account suspension.
- Callers who already know your name, birth date or loan details and use them to sound genuine while asking for an OTP, PIN or card number.
- Fake loan officers or 'recovery agents' using leaked loan and lead data to demand payments or offer pre-approved loans for an upfront fee.
- Look-alike SBI websites and apps sent by SMS, built to capture net banking credentials.
What to do if you are affected
- 01Never share an OTP, PIN, CVV or password with anyone, including someone who says they are from SBI. The bank does not ask for them.
- 02Do not click links in SMS or WhatsApp messages about KYC, account blocks or loans. Open the official SBI app or type the address yourself.
- 03Check your account statements and turn on SMS and email transaction alerts.
- 04If you get a suspicious call, hang up and call the number printed on your card or passbook.
- 05Report suspected fraud to your bank at once and to the police cybercrime authorities.
Frequently asked questions
Was SBI hacked in October 2026?
Not confirmed. SBI told the stock exchanges it received alerts of suspected customer data on the dark web and has not yet verified the data's authenticity, source or extent.
What did CERT-In say about the SBI data leak?
According to SBI's filing as described by the Internet Freedom Foundation, CERT-In was one of three parties that alerted the bank on October 16, alongside SBI's threat intelligence vendor and the Defence Cyber Agency. We did not find a separate public CERT-In statement.
How many SBI customers are affected by the dark web leak?
SBI's preliminary analysis of about 3.75 lakh (375,000) records found 3,897 customer records with personal information. A threat actor also claimed 2,722 PDF documents, which the filing does not address.
Is my SBI money safe after the data leak?
SBI said core operations and business continuity are not affected. The exposed fields reported do not include passwords or card numbers, but leaked contact details can be used for fraud calls.
How do I know if my SBI data was leaked?
SBI's filing does not say whether affected customers are being notified, and the Internet Freedom Foundation has asked it to do so. Treat any unexpected call or SMS about KYC or loans with caution until you hear from the bank directly.
Sources
- Is your bank account safe? 3,897 SBI customers' data leaked on dark web, The Week, 2026-10-21
- State Bank of India confirms data leak, The Hacker News, 2026-10-21
- SBI told investors its data breach doesn't matter. What about the 3,897 customers it affected?, Internet Freedom Foundation, 2026-10-21
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.