The State Bank of India (SBI) has officially confirmed that personal information of 3,897 customers surfaced on the dark web, raising concerns over transparency and customer protection as the bank has not publicly confirmed whether affected customers were informed.
- SBI reports breach affecting 3,897 customers to stock exchanges
- Exposed data appeared on dark web among over 375,000 leaked records
- No confirmation from SBI on informing customers about the breach
What happened
In October 2026, the State Bank of India confirmed that personal data of 3,897 customers had been discovered on the dark web. This data included mobile phone numbers, dates of birth, and home addresses and was part of a larger leak comprising around 375,000 records. The bank reported this breach to the Bombay Stock Exchange and National Stock Exchange following mandatory disclosure regulations.
The compromised information came to light through communications from the Defence Cyber Agency and India's Computer Emergency Response Team (CERT-In). SBI stated that a thorough investigation was underway to verify the data's authenticity and to identify how the breach happened, though details on the wider dataset and whether other sensitive documents were involved remain undisclosed.
Why it matters
While SBI has fulfilled regulatory requirements to inform market regulators and investors, the breach highlights gaps in customer notification protocols in India. The current legal framework delays mandatory individual notification of data breaches until May 2027, leaving affected customers uninformed about the exposure of their personal details.
This delay raises significant concerns about customer risk management and the protection of sensitive personal data held by major financial institutions. Industry groups and digital rights advocates have urged SBI to directly notify impacted individuals immediately and have called for regulatory reforms to expedite mandatory breach notifications to consumers.
What to watch next
Market watchers and regulators will be monitoring SBI’s ongoing investigation and any steps it takes to communicate with affected customers. Future developments may include SBI clarifying what additional data was exposed and whether documents such as Aadhaar or PAN cards are included in the breach.
There is growing pressure on Indian regulators, including the RBI and Ministry of Electronics and Information Technology, to implement and enforce more immediate data breach notification rules. Updates from these authorities and SBI’s response to the breach could set important precedents for how financial data breaches are handled in India.