SBI discloses 'data loss': 3,897 customer records with personal details found on the dark web

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

State Bank of India told the stock exchanges on 21 October that a check of about 3.75 lakh records found online found 3,897 with customers' names, mobile numbers, dates of birth and addresses. It has not said where the data came from. What was exposed, and what SBI customers should watch for.

01 / What happened

State Bank of India said in a filing to BSE and NSE on 21 October 2026 that it 'has experienced an incident involving the loss of certain data'.

• On 16 October, SBI received alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In about suspected exposure of its customer data on the dark web.
• In a preliminary check of about 3,75,000 records found there, it identified 3,897 customer records containing personal information.
• SBI activated its incident response and hired an independent CERT-In-empanelled agency to investigate. It said there was no material impact on its core operations or business continuity.

02 / What was exposed, and what was not

According to SBI's filing, the exposed records reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF (customer) identifiers, lead IDs, and details linked to loan and lead records.

The filing does not mention passwords, PINs, OTPs, card numbers, PAN or Aadhaar, and SBI says it is still establishing whether the data is authentic and complete, and where it came from. It does not say whether affected customers will be told.

03 / Confirmed vs. claimed

Confirmed (SBI's exchange filing): the alerts on 16 October, the 3,75,000 records checked, 3,897 with personal information, the kinds of data, and the investigation. Claimed: a seller on a breach forum said it leaked about 3,75,000 rows and 2,722 PDF documents, including loan applications, The Hacker News reported; SBI has not addressed that claim. Not known: whether 3,897 records means 3,897 different customers, the source of the data, and whether SBI's own systems were breached. The Internet Freedom Foundation criticised SBI for telling investors before customers.

04 / What SBI customers should do

• Expect convincing calls and messages about 'loan approval', 'KYC update' or 'account block' that quote your real details. Hang up and call SBI only on the number on your card, passbook or the YONO app.
• Never share an OTP, PIN, card details or screen, and never install an app sent on WhatsApp or SMS.
• Watch your account and any loan enquiries in your name; our guide to checking loans on your PAN explains how.
• More steps: what to do after a data breach. Lost money? Call 1930 and see our lost-money checklist.
• All 2026 incidents at Indian organisations: India breach tracker.