SBI Data Leak Shock! 3.75 Lakh Customer Records Reportedly Surface on Dark Web

The State Bank of India (SBI) is investigating a suspected data leak after around 3.75 lakh records reportedly surfaced on the dark web. During its initial investigation, the bank identified 3,897 customer records containing personal information. The issue came to light after SBI received alerts from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) on 16 October 2026.

SBI Data Leak Shock!

Following these alerts, SBI started its cybersecurity response process and appointed an independent cybersecurity agency to investigate the matter. The investigation will help the bank understand how the information became available, whether the records are genuine and what risks they may pose to customers. SBI has stated that the incident has had no material impact on its core operations, financial performance or business continuity.

What Happened in the SBI Data Leak Case?

• The SBI data leak case came to attention after the bank received alerts about customer-related information reportedly available on the dark web. The alerts were received on 16 October 2026 from its threat intelligence service provider, the Defence Cyber Agency and CERT-In.
• SBI then examined approximately 3.75 lakh records. During this initial assessment, the bank identified 3,897 records containing customers’ personal information.
• It is important to understand that these two numbers mean different things. The 3.75 lakh figure refers to the total records examined, while 3,897 refers to the records identified as containing personal information during the preliminary analysis.
• The bank is now investigating how the information became available online and whether any customers face a risk. The exact source of the exposure and the total number of individuals potentially affected have not yet been conclusively established.

What SBI Customer Information Was Reportedly Exposed?

The initial findings indicate that some records contained personal and customer-related information. The reported details include:

• Customer names and registered mobile numbers
• Dates of birth and gender
• Email addresses and residential addresses
• Bank branch details and Customer Information File (CIF) identifiers
• Lead IDs and information related to loan applications or customer leads

How Is SBI Responding to the Data Leak?

SBI has started its cybersecurity response process and appointed an independent cybersecurity agency to investigate the suspected data exposure. The investigation will focus on three important questions:

1. Is the exposed information genuine? The agency will examine the records to determine whether they contain authentic SBI customer information and assess how complete the dataset is.
2. How did the information become available online? The investigation will look into the possible source of the exposure and how the records may have reached the dark web.
3. What risks could customers face? The assessment will help determine the extent of the exposure and whether further protective steps are required. SBI has stated that the incident has had no material impact on its core banking operations, financial performance or business continuity. Further details about the source and extent of the exposure will depend on the investigation’s findings.

Has the SBI Data Leak Affected Banking Services?

According to SBI, the incident has had no material impact on its core operations, financial performance or business continuity. The suspected exposure of customer information does not, by itself, prove that SBI’s core banking systems have been hacked or that customers’ bank accounts have been compromised.

Still, customers should not ignore the news. Personal information can sometimes be used to make fraudulent calls and messages appear genuine. Staying alert and verifying unusual requests can help prevent online banking fraud.

What Should SBI Customers Do to Stay Safe?

News about a possible data leak can naturally make customers worried about their money and personal information. While the investigation is underway, there are some simple steps every customer can follow to stay safe.

1. Never Share Your OTP or ATM PIN

Never share your OTP, ATM PIN, CVV, password or internet banking credentials with anyone over a phone call, message or email. Do not share these details even if the person claims to be an SBI employee.

2. Be Careful About Calls From Fake Bank Officials

Fraudsters may use personal details to convince people that they are genuine bank representatives. If someone asks you to verify your account or share confidential information, stop and contact SBI through its official channels.

3. Do Not Click on Unknown Links

Avoid clicking on suspicious links that claim to check whether your data has been leaked, verify your bank account or offer compensation. Such links may lead to fraudulent websites designed to steal your information.

4. Check Your Bank Transactions Regularly

Keep an eye on your account statements and transaction alerts. If you notice a transaction you do not recognise, contact your bank immediately.

5. Report Suspicious Transactions Without Delay

If you suspect that someone has accessed your account or made an unauthorised transaction, report it to SBI immediately through its official channels.

6. Do Not Believe Every Message About the Data Leak

You may come across messages claiming that all SBI customers’ details have been leaked or that every bank account is at risk. Avoid forwarding such claims unless they are supported by reliable information. These are general safety measures for all digital banking users. They do not mean that every SBI customer has been affected by this incident.