India’s largest public-sector lender, State Bank of India, has disclosed a cyber incident resulting in the loss of sensitive data belonging to thousands of customers, with leaked information reportedly appearing on the dark web.
- Approximately 3,900 SBI customer records with personal data leaked
- Bank working with CERT-In and independent cybersecurity experts
- Investigation ongoing; authenticity and breach source remain unconfirmed
What happened
In mid-October 2026, SBI was alerted by its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In after data suspected to be related to the bank appeared for sale on dark web forums. The exposed dataset reportedly includes 375,000 entries, with nearly 3,900 containing Personally Identifiable Information (PII) of SBI customers, such as names, mobile numbers, dates of birth, residential addresses, and loan-related metadata.
Though the bank has confirmed the incident in a regulatory filing, it has not yet established when or how the data leak occurred, nor the identity of the perpetrator. SBI activated its cyber incident response protocols immediately and commissioned an independent CERT-In-empanelled cybersecurity firm to conduct forensic analysis.
Why it matters
As India’s largest public-sector bank serving millions of customers, any data breach affecting SBI carries serious implications for customer privacy and financial security. The leaked personal and loan data could facilitate highly targeted phishing attacks or malware campaigns, exposing customers to further scams or fraud.
A confirmed leak of this nature can undermine trust in the institution, potentially triggering regulatory scrutiny, legal challenges, and reputational damage. Given the inclusion of detailed customer application and identification information, the risk of downstream fraud and identity theft increases significantly.
What to watch next
The bank’s ongoing investigation will aim to verify the leak’s authenticity, map its source, and determine the scale of data exposure. Monitoring announcements from SBI, CERT-In, and the Defence Cyber Agency will help clarify the incident’s impact and next steps regarding customer protection measures.
Customers should remain vigilant against suspicious communications, especially those that mimic bank correspondence requesting urgent action or sensitive information. The situation underscores the importance of robust cybersecurity practices both for financial institutions and their clients to mitigate risks of secondary attacks following such breaches.