The State Bank of India (SBI) has reported a suspected exposure of customer information after identifying 3,897 records containing personally identifiable information during a preliminary examination of data available on the dark web. The disclosure has raised concerns about customer privacy and cybersecurity in India's banking sector.
In a regulatory filing dated October 21, 2026, SBI said it had received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
The bank's preliminary analysis covered approximately 375,000 records found on the dark web. Of these, 3,897 records were identified as containing information that could be used to identify individual customers. SBI said a detailed investigation was necessary to establish the authenticity and completeness of the information, determine its possible source and assess the risks to customers and the bank.
The bank has activated its cyber incident response and containment procedures and engaged an independent cybersecurity agency empanelled by CERT-In to investigate the incident.
What Information Was Reportedly Exposed?
According to SBI's disclosure, the records identified during the preliminary review reportedly contained several types of personal and customer-related information.
The information included registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. It also reportedly included branch identifiers, Customer Information File identifiers, lead IDs and metadata associated with loan and lead records and other related files.
Customer Information File identifiers are used by banks to organise customer information. Their appearance alongside other personal details could increase the risk of targeted fraud if the information is authentic and misused.
However, the preliminary findings do not establish that every record among the approximately 375,000 entries contains SBI customer information. The bank is still investigating the authenticity and extent of the suspected exposure.
The disclosure also does not establish the precise route through which the information became available on the dark web. The investigation is expected to help determine the possible source and scope of the incident.
How Did SBI Respond to the Incident?
SBI said it acted after receiving alerts from its threat intelligence service provider, the Defence Cyber Agency and CERT-In on October 16.
The bank activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment.
The investigation is intended to verify the exposed information, establish the possible source of the incident and determine whether additional customer records may be affected. It will also assess the potential consequences for customers and the bank.
SBI has said that the incident has had no material impact on its core business operations, financial performance or business continuity. Its core banking functions continue to operate normally, according to the bank's disclosure.
This means the bank has reported no material disruption to its main operations. However, the operational status does not remove the need to investigate the suspected exposure or assess the potential risks associated with personal information appearing online.
Are SBI Accounts and Deposits Safe?
SBI has stated that its core banking operations remain unaffected. Reuters also reported the bank's assurance that customer account balances remain safe.
However, customers should distinguish between the safety of account balances and the possible misuse of personal information. If authentic personal details are available to unauthorised individuals, they could potentially be used in phishing attempts, impersonation scams or fraudulent communications.
The information identified in the preliminary review includes contact details and identifiers associated with customer and loan records. Such information could make a fraudulent message appear more convincing because it may refer to a person's name, branch or other familiar details.
The bank's investigation is still underway, and the full extent of the suspected exposure has not been established. Customers should therefore remain cautious without assuming that their own information has necessarily been exposed.
What Should SBI Customers Do Now?
Customers can take several precautionary steps while the investigation continues.
First, they should be alert to unexpected calls, text messages, emails and messaging-app communications claiming to come from SBI. Fraudsters may use personal details to make requests for verification appear genuine.
Second, customers should never share one-time passwords, PINs, internet banking passwords or card security details with anyone contacting them unexpectedly. Banks do not need customers to disclose these confidential credentials over unsolicited calls or messages.
Third, customers should avoid clicking suspicious links or downloading attachments that claim to offer account verification, refunds or security updates. Instead, they should use SBI's official website, verified application or established customer service channels.
Customers should also monitor account statements and transaction alerts for unfamiliar activity. If they notice suspicious transactions or believe their credentials have been compromised, they should contact the bank promptly through official channels and take the recommended protective steps.
These precautions are useful general safeguards. They do not mean that every SBI customer is affected by the incident.
What Is the Dark Web?
The dark web refers to online services that are not generally accessible through standard web browsers and often require specialised software or configurations. Some dark web platforms are used for legitimate privacy-related purposes, while others are associated with illegal marketplaces and the circulation of stolen information.
Personal data appearing on the dark web does not automatically prove how it was obtained or who was responsible for its exposure. Investigators need to examine the authenticity of the material, its origin and whether it was obtained through unauthorised access.
In the SBI case, the bank's preliminary review identified 3,897 records containing personally identifiable information within a much larger collection of records. The investigation must establish what the records represent and how the information became available.
Why the Incident Matters for Banking Cybersecurity
Banks manage large volumes of personal, financial and identity-related information, making data protection a major cybersecurity priority. Even when core banking services continue without disruption, the suspected exposure of personal records can raise concerns about privacy, fraud prevention and customer confidence.
The SBI incident highlights the importance of identifying unusual data exposure, responding quickly to alerts and investigating whether information has been accessed or distributed without authorisation.
For customers, the case also demonstrates why cybersecurity precautions remain important even when a bank's main services are operating normally. Fraudsters can exploit personal information through social engineering, attempting to persuade people to reveal passwords, approve transactions or disclose confidential details.
SBI has said that its assessment is continuing and that appropriate remedial and preventive measures will be taken as required. Further findings from the investigation should help clarify the scope of the incident and the measures needed to address any identified weaknesses.
What Happens Next?
The immediate priority is to establish whether the identified records are authentic, determine how the information reached the dark web and assess the extent of any compromise. SBI has engaged an independent cybersecurity agency to support this work.
The bank has stated that its core operations, financial performance and business continuity have not been materially affected. However, the investigation remains important for determining the potential risks to customers whose information may be involved.
For now, customers should follow official SBI communications, remain alert to suspicious approaches and avoid sharing confidential banking credentials. They should rely on verified information from the bank and relevant authorities rather than unverified claims circulating online.
The case is a reminder that protecting personal information is an important part of banking security, alongside safeguarding transactions and maintaining uninterrupted services.
