NEW DELHI | OCTOBER 21, 2026 | DWEEP TULIKA | NATIONAL
Customers of the State Bank of India (SBI) are being urged to remain vigilant after the bank disclosed a suspected data exposure involving customer-related information found on the dark web. SBI said its preliminary analysis of approximately 3.75 lakh records identified 3,897 customer records containing personally identifiable information (PII).
In a disclosure to stock exchanges on Wednesday, October 21, the country’s largest public sector lender said it had experienced an incident involving the loss of certain data. The bank has initiated a detailed investigation to establish the authenticity and completeness of the exposed information, determine its possible source and assess the risks to customers.
SBI has stated that the incident has had no material impact on its core business operations, financial performance or business continuity. The investigation into the suspected data exposure is ongoing.
How the Incident Came to Light
According to SBI’s disclosure, the bank received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure of customer information on the dark web.
Following the alerts, SBI activated its cyber incident response and containment protocols. It also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment.
The investigation is intended to establish whether the information is authentic and complete, how it may have been exposed, the extent of the incident and the potential risks to the bank and its customers.
The bank has not yet publicly established the precise source of the data or how it left the relevant systems or data-handling environment.
What Customer Information May Have Been Exposed?
SBI’s preliminary analysis identified customer records containing personally identifiable information. The information reportedly includes:
Customers’ names and registered mobile numbers
Dates of birth and gender
Email addresses and residential addresses
Branch identifiers and Customer Information File (CIF) identifiers
Lead IDs and metadata associated with loan and customer-lead records and related files
The presence of such information can create risks even if account credentials have not been exposed. Fraudsters may use genuine personal details to make calls, emails or messages appear credible, impersonate bank officials or target customers with tailored phishing attempts.
However, the authenticity and completeness of the dataset remain under investigation. The bank has not established publicly that every item in the wider dataset is genuine SBI customer information.
Does This Mean 3.75 Lakh SBI Accounts Were Hacked?
No such conclusion can be drawn from the figures disclosed so far.
The approximately 3.75 lakh figure refers to the number of records SBI examined in the dataset available on the dark web. Within that dataset, its preliminary analysis identified 3,897 customer records containing personally identifiable information.
The two figures should not be treated as equivalent. The bank has not confirmed that all 3.75 lakh records belong to SBI customers, nor does the number of records necessarily represent an equal number of unique individuals or bank accounts.
The investigation also needs to establish where the data originated and whether the exposure involved SBI’s own systems, a third-party service provider or another part of the data-handling process.
The disclosure therefore points to a significant customer-data security concern, but it does not by itself establish that 3.75 lakh bank accounts were hacked or that funds were stolen.
SBI Says Core Operations Remain Unaffected
SBI said the incident has had no material impact on its core business operations, financial performance or business continuity.
The bank has said that a detailed assessment is underway and that appropriate remedial and preventive measures are being implemented as required.
This assurance concerns the reported impact on the bank’s operations and financial performance. It should not be interpreted as confirmation that every potentially affected customer faces no risk, because the investigation into the exposed information is continuing.
What Should SBI Customers Do?
Customers should be alert to unexpected calls, SMS messages, emails and WhatsApp messages claiming to come from SBI or another financial institution. Personal information can make fraudulent communications appear genuine.
Customers should take the following precautions:
Never share OTPs, PINs or passwords. Do not disclose internet banking credentials, card PINs or one-time passwords to anyone claiming to represent the bank.
Be cautious of personalised messages. A caller knowing your name, mobile number, address or loan-related details does not prove that the person is an authorised bank employee.
Avoid suspicious links and attachments. Do not click links in unexpected messages or install applications at the request of an unknown caller. Access SBI services through its official website or verified application.
Check account activity regularly. Review transactions and bank alerts. Report unfamiliar transactions or suspicious account activity immediately through official SBI channels.
Secure your accounts. Use strong, unique passwords where applicable and enable available security protections. Never approve a transaction or screen-sharing request that you did not initiate.
Report suspected financial fraud promptly. If money has been lost to cyber fraud in India, contact the national cybercrime helpline at 1930 as soon as possible and submit a complaint through the official portal at cybercrime.gov.in. Also notify your bank immediately.
Customers should rely on official bank communications for confirmed instructions about the incident. They should not assume that their information has been exposed solely because they hold an SBI account, but they should remain alert to suspicious approaches.
Investigation Continues
SBI has engaged an independent CERT-In-empanelled cybersecurity agency to examine the nature and extent of the suspected compromise. The investigation is expected to clarify the origin and authenticity of the dataset and the potential risks to customers.
Until further findings are disclosed, the distinction between the wider dataset and the 3,897 customer records identified in the preliminary analysis remains important. The bank has reported no material impact on its core operations, but questions about the source and full extent of the data exposure remain unresolved.
For customers, the immediate priority is to protect banking credentials, scrutinise unexpected communications and report suspicious activity through official channels.