SBI Data Breach: SBI Flags Exposure of 3,897 Customer Records on Dark Web
-
Khushi Jain
- October 21, 2026
State Bank of India (SBI) has flagged the exposure of 3,897 customer records containing personally identifiable information on the dark web. The information reportedly includes mobile numbers, dates of birth, email addresses and residential addresses.
In an exchange filing, the public sector lender said its preliminary analysis of around 3.75 lakh records available on the dark web identified 3,897 customer records containing personal information.
The exposed data also included branch details, customer information file identifiers, lead IDs and metadata associated with loan and lead records, according to the bank.
SBI said it received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
The disclosure follows claims attributed to a threat actor operating under the name Siriusim, which were shared on X by cybersecurity account CyberPulse56. The actor claimed to possess around 3.75 lakh rows of SBI-linked data and 2,722 PDF documents, including loan applications, supporting documents and account-opening forms. Inc42 said it could not independently verify these claims.
The number of records examined does not establish that 3.75 lakh customers were affected. SBI’s preliminary findings specifically identified 3,897 customer records containing personal information.
SBI Launches Probe Into Data Exposure
SBI said it had activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to investigate the incident.
The investigation will seek to establish the authenticity and completeness of the data, identify the source and extent of the exposure, and assess potential risks to customers and the bank.
The lender said its core banking and business functions continued to operate normally, with no material impact on operations, financial performance or business continuity. It added that remedial and preventive measures were being implemented while the assessment continued.
Cybersecurity Concerns Across India’s Financial Sector
The incident comes amid growing concerns over AI-driven cybercrime and digital fraud. State-run Punjab National Bank (PNB) has also warned customers about threats such as AI-generated voice clones, deepfakes and phishing attacks.
The SBI incident follows other customer data breaches involving Indian financial services companies.
In February last year, Angel One disclosed unauthorised access to some of its Amazon Web Services resources after receiving alerts from its dark-web monitoring partner.
Earlier, personal data belonging to over 3 crore Star Health customers surfaced for sale online. The information included names, addresses, PAN details and medical histories.
Star Health reported the breach to CERT-In and the insurance regulator, initiated a forensic investigation and moved court to restrict access to the leaked information.
FAQs
1. How many SBI customer records were identified in the preliminary analysis?
SBI identified 3,897 customer records containing personally identifiable information in its preliminary analysis.
2. What type of customer information was reportedly exposed?
The information included mobile numbers, dates of birth, email addresses, residential addresses, branch details, customer information file identifiers, lead IDs and metadata associated with loan and lead records.
3. When did SBI receive alerts about the suspected data exposure?
SBI said it received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and CERT-In.
4. What steps has SBI taken to investigate the incident?
SBI activated its cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to investigate the exposure.
5. Did the incident affect SBI’s business operations?
SBI said its core banking and business functions continued to operate normally, with no material impact on operations, financial performance or business continuity.
