SBI Data Breach: Nearly 3,900 Customer Records Exposed

India’s largest public sector lender, State Bank of India (SBI), has confirmed a customer data exposure incident after identifying 3,897 records containing personal information in material discovered on the dark web.

The bank disclosed the incident to stock exchanges on October 21, 2026, following cybersecurity alerts received on October 16 from intelligence agencies and cybersecurity authorities.

SBI stated that its banking operations remain unaffected while an investigation continues to determine the source and extent of the exposure.

SBI Identifies Thousands of Exposed Customer Records

According to SBI’s official disclosure, the bank examined approximately 375,000 records and initially identified 3,897 customer records containing personally identifiable information.

The exposed details reportedly include customer names, registered mobile numbers, dates of birth, email addresses, residential addresses and branch information.

Some records also contained Customer Information File (CIF) identifiers and loan related information.

However, the bank has not confirmed whether passwords, PINs, OTPs or payment credentials were compromised.

Bank Launches Cybersecurity Investigation

Following the alerts, SBI activated its incident response procedures and engaged an independent cybersecurity agency approved by the Indian Computer Emergency Response Team (CERT-In).

Investigators are examining the authenticity of the exposed information, how it became accessible and whether additional customer records were affected.

The bank has not established whether hackers directly accessed its internal systems.

SBI also clarified that the incident has not materially affected its financial performance, banking services or business continuity.

Cybersecurity Experts Warn Customers About Fraud Risks

Although unauthorized account access has not been confirmed, exposed personal information could increase the risk of phishing attacks, identity theft and financial fraud.

Customers are advised to monitor account transactions, avoid suspicious links and never share banking passwords, PINs or OTPs.

Anyone noticing unauthorized transactions should immediately contact SBI through official banking channels.

Financial cyber fraud can also be reported through India’s national cybercrime helpline, 1930, or the government portal at cybercrime.gov.in.

SBI Continues Investigation Into Data Exposure

SBI is implementing corrective and preventive security measures while investigating the incident.

The final number of affected customers, the origin of the exposed records and whether individual customers will receive direct notifications remain unclear.

Further details are expected as the investigation progresses.