SBI Data Leak of 3,897 Customers: Three Agencies Flagged Breach Before Bank Could Detect It; Raising Questions Over Delay in Customer Alerts and Internal Security Protocols

ON OCTOBER 16, 2026, three agencies alerted the State Bank of India (SBI), India’s largest public sector bank, about the suspected exposure of its customers’ data on the dark web. Despite being considered one of India’s most reputed banks, SBI was unable to detect the suspected breach on its own. Even after receiving the alerts, the bank took several days to inform the public about the data leak, providing only vague details.

The incident raises questions: how did the breach happen, and how did the bank become aware of it? The data loss incident involved the exposure of customer data on the dark web. It was suspected after the personal information of around 3,897 customers was found in a dataset on the web online.

SBI Statement to Customers on Data Breach

SBI on October 21, 2026 disclosed a data breach incident to its customers. The bank posted an ‘Important Information’ notice for its public, mentioning that a cyber incident had occurred, leading to a data leak. It further said that the impact had affected “a very very small number of customers.”

See Also: Jantar Mantar Protest Against CEC Gyanesh Kumar Live: Hundreds of Protesters Detained from Jantar Mantar and Surrounding Areas

The bank said that the incident had not affected its IT systems or core business, and services would continue as usual. In its October 21 notice, the bank also stated, “Customers balance are completely safe and we are taking all possible steps to protect the interest of our valuable customers.” At the end, it reiterated that customers’ financial assets were safe and that “their trust in us remain our highest priority.”

Details of the SBI Data Leak Incident So far

The country’s largest state-run lender said a preliminary investigation identified records of 3,897 customers containing personally identifiable information (PII) among approximately 3.7 lakh records available on the dark web. The bank provided information about the breach under Regulation 30 of the Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015, regarding an incident involving data loss.

Under this disclosure, the bank stated, “The bank has experienced an incident involving the loss of certain data.” While the lender issued the public notice on October 21, it had received alerts about the data breach on October 16, 2026, from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

The bank further mentioned that the exposed personal details included names, gender, phone numbers, dates of birth, addresses, email addresses, branch details, CIF identifiers, lead IDs and metadata associated with customers’ personal loan and lead records. SBI said a detailed investigation was needed to establish the authenticity of the exposed data. This would also help determine the potential source of the breach and the extent of the exposure.

The bank said it had activated its cyber incident response protocols and engaged an independent CERT-In-empanelled agency to conduct a thorough assessment. The bank also mentioned that the incident had no material impact on its core business and that it would continue to operate normally without any disruptions.

The incident first came to light when a cybersecurity monitoring account, CyberPulse50, made a post on X. According to The Indian Express, the group claimed to have 3.7 lakh entries in CSV format and 2,722 PDF documents associated with SBI customers. Under India’s Digital Personal Data Protection Act, 2023, SBI could be penalized for failing to employ reasonable security measures to prevent the data breach.

See Also: Can the Election Commission Block Any State's Access to Voter Data via ECINET? Digital Audit Reveals EROs and AEROs from West Bengal Restricted from Accessing Enumeration Forms, Notice and Hearing Details

Internet Freedom Foundation Questions SBI Security and Threat Detection Protocols

The Internet Freedom Foundation (IFF) made a detailed post on X, saying that customers affected by the breach needed to be informed directly and without delay. It asked SBI to notify affected customers through SMS, emails or letters and provide a dedicated helpline to help them handle the situation and maintain transparency. The IFF wrote, “The bank says it does not yet know where the data came from, and it has engaged a CERT-In empanelled agency to find out.”

It further mentioned, “SBI did not detect this breach itself and learnt of it from outside agencies after the data had already been published. On the same day, a threat monitoring account on X flagged a claim by a group calling itself “Siriusim” that it had released 3.75 lakh rows of SBI data and 2,722 PDF documents, including loan applications and account opening forms.” It also said that the bank had not mentioned the remaining records beyond the 3,000-plus customers identified.

The organization highlighted that SBI had not mentioned whether it had informed the customers affected by the breach. It said, “These customers are the most likely to receive calls from persons posing as SBI officials who can recite their account details back to them. A customer cannot guard against a fraud she has not been warned of.” It made five demands in this case, including greater transparency about what the documents contained and whether they included Aadhaar details, KYC documents and other sensitive information.

The organization further wrote in the post, “When the investigation concludes, SBI must disclose how the data left its systems, including whether it came through a vendor or a direct selling agent, and publish a summary of the investigating agency’s findings.” It also demanded the Reserve Bank of India to direct all regulated entities so that the customers are informed about it. It said, “The Ministry of Electronics and Information Technology should bring Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules into force immediately.”

The news of this breach raised concerns among many citizens, particularly those who may be at risk of fraud and are not well-informed. Customers are advised not to panic, as the bank is still examining the origin of the data leak. They should remain alert but not assume that their accounts have been hacked or that someone has accessed their bank accounts.

(Edited by Harsh Pandey)

[Rh/VP/HP]

Suggested Reading: