started · updated
State Bank of India confirms exposure of 3,897 customer records on dark web
The State Bank of India (SBI) has confirmed a data breach after discovering that 3,897 customer records containing personally identifiable information (PII) were exposed on the dark web. The bank initiated its cyber incident response protocols following alerts received on October 16, 2026, from its threat intelligence provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In).
A preliminary analysis of approximately 375,000 records found on the dark web identified the compromised data. The exposed information includes customer names, registered mobile numbers, dates of birth, gender, email addresses, and residential addresses. Additionally, the breach involves banking identifiers such as branch details, Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan applications and other digital documents.
SBI has engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive investigation into the nature and extent of the compromise. The bank stated that the incident has no material impact on its core business operations, financial performance, or business continuity, and assured customers that account balances remain safe. The Internet Freedom Foundation has called on the bank to notify all affected customers regarding the specific information exposed.
Entities
CERT-In · CyberPulse56 · Defence Cyber Agency · India · Internet Freedom Foundation · Siriusim · State Bank of India
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 25 SOURCES] A preliminary analysis involved approximately 375,000 records on the dark web. navabharat.news · www.khabarfast.com · bhaskarlive.in · businessconnectindia.in · hindi.business-standard.com · +20 more
- [● 24 SOURCES] SBI identified 3,897 customer records containing PII on the dark web. navabharat.news · www.khabarfast.com · bhaskarlive.in · businessconnectindia.in · hindi.business-standard.com · +19 more
- [● 7 SOURCES] Siriusim claimed to possess 2,722 PDF documents and 375,000 CSV rows of data. www.businesstoday.in · nationalcybersecurity.com · www.ibtimes.co.in · indusbusinessjournal.com · businessconnectindia.in · +1 more
- [● 21 SOURCES] The bank received alerts on October 16 from CERT-In and the Defence Cyber Agency. navabharat.news · www.khabarfast.com · bhaskarlive.in · businessconnectindia.in · www.bhaskarhindi.com · +16 more
- [● 8 SOURCES] A hacker group named Siriusim claimed to have obtained SBI customer data. businessconnectindia.in · www.businesstoday.in · nationalcybersecurity.com · www.ibtimes.co.in · indusbusinessjournal.com · +1 more
- [● 15 SOURCES] The incident has no material impact on SBI's core business operations or financial performance. www.khabarfast.com · bhaskarlive.in · businessconnectindia.in · hindi.business-standard.com · www.bhaskarhindi.com · +10 more
- [● 22 SOURCES] Exposed data includes names, mobile numbers, dates of birth, and residential addresses. navabharat.news · bhaskarlive.in · businessconnectindia.in · hindi.business-standard.com · www.bhaskarhindi.com · +17 more
- [● 19 SOURCES] SBI engaged an independent cybersecurity agency to investigate the compromise. navabharat.news · www.khabarfast.com · bhaskarlive.in · businessconnectindia.in · hindi.business-standard.com · +14 more