SBI Admits Exposure of its Customer Data

Synopsis

The State Bank of India (SBI) disclosed a suspected data exposure on the dark web. A preliminary assessment identified about 3.75 lakh records, including 3,897 customer records containing personally identifiable information. The country’s largest state-run lender disclosed the incident in a filing with stock exchanges on October 21, 2026.

What Actually Happened?

In a letter dated October 21, 2026, to the BSE and the National Stock Exchange, SBI said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about the suspected exposure of customer data on the dark web.

The leaked information includes customers’ names, gender, registered mobile numbers, dates of birth, email addresses and residential addresses. The records also contain branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records.

SBI said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about the suspected exposure. The bank activated its incident response procedures and appointed an independent cybersecurity agency empanelled with CERT-In to investigate.

“The Bank promptly activated its cyber incident response and containment protocols.” It added that the incident had no material impact on its business operations, financial performance or business continuity. The bank also said, “The Bank’s core business functions continue to operate normally without disruptions,” SBI said in its exchange filing.

The Measures Taken

SBI said it needed a detailed investigation to verify the authenticity and completeness of the exposed data, identify the potential source and extent of the exposure, and assess risks to customers and the bank.

The bank said it activated its cyber incident response and containment protocols after receiving the alerts. It then engaged an independent cybersecurity agency empanelled by CERT-In to assess and investigate the nature and extent of the suspected compromise.

The Risk with the Leak

The exposure raises concerns for customers, particularly over the risk of targeted financial fraud. SBI, however, said the incident had no material impact on its core business operations, financial performance or business continuity.

The bank added that its core functions continued to operate normally without disruption. A detailed assessment was underway, and remedial and preventive measures were being implemented as required.