What happened here
Records of 3,897 State Bank of India customers, found among about 3.75 lakh records on the dark web, carry names, mobile numbers, dates of birth, addresses and loan-lead details, SBI told the stock exchanges on 21 October 2026. The source is unknown and the poster claims far more. SBI says funds are safe and customers have been informed. The risk is impersonation calls. Updated 27 October 2026.
Quick answers
What happened in the SBI data leak?
SBI told the stock exchanges on 21 October 2026 that, of about 3.75 lakh records found on the dark web, 3,897 held customer personal information. A poster on BreachForums claimed much more on 16 October. The source of the data is not known.
What data was exposed?
Reportedly names, gender, registered mobile numbers, dates of birth, email and home addresses, branch and CIF identifiers, and loan and lead details. The filing does not list account numbers, balances, passwords, OTPs, card details, PAN or Aadhaar.
Is my money safe?
SBI says account balances and funds are safe and core services were not affected. Nobody has reported a theft linked to this leak in the reports we read. The risk is a convincing fraud call, so verify callers.
How do I know if I was affected?
SBI says affected customers have been individually informed. If you did not get a message, you may not be one of the 3,897; confirm only through the bank's app, website or its official number.
What should I do if someone calls claiming to be from SBI?
Do not share any code or PIN. Hang up and call the number on your card or passbook. If money has gone, call 1930 and file at cybercrime.gov.in.
What happened
On 16 October 2026 a user calling themselves “Siriusim” posted on the BreachForums criminal marketplace, claiming to hold 375,000 rows of State Bank of India (SBI) customer data and 2,722 PDF documents, including loan applications and account-opening forms. A cyber-intelligence account, CyberPulse56, flagged the post on X the same day. SBI says it got alerts on 16 October from its threat-intelligence provider, the Defence Cyber Agency and CERT-In.
The claim spread in the following days. Business Today reported on 20 October that it had not been verified, and the Economic Times, as cited there, said SBI had not replied to its questions. On Wednesday 21 October SBI told the BSE and NSE that it “has experienced an incident involving the loss of certain data”. A preliminary check of about 3.75 lakh records on the dark web, it said, found 3,897 customer records containing personal information. On 23 October the bank said it had individually informed the customers concerned and that account balances and funds were safe. Updated 27 October 2026.
What the bank says was exposed
According to the exchange filing as reported, the data “reportedly included” registered mobile numbers, dates of birth, names, gender, email and residential addresses, branch and customer information file (CIF) identifiers, lead IDs and details tied to loan and lead records. The filing does not list account numbers, balances, passwords, OTPs, card details, or PAN or Aadhaar numbers. SBI says there is no material impact on its core business, finances or continuity.
That is a statement about the bank, not about the people in the file. The Hacker News makes the same point: the risk to customers is impersonation. A caller who knows your name, number, date of birth, branch and loan details sounds far more believable.
What is confirmed and what is not
- Confirmed by SBI: an incident involving data loss; 3,897 records with personal information found within about 3.75 lakh records examined; an independent agency from CERT-In’s empanelled panel has been brought in; affected customers have been informed (SBI statement of 23 October, as reported).
- Claimed by the poster, not confirmed: 375,000 CSV rows and 2,722 PDFs, including loan applications and account-opening forms. The Hacker News reports that Free Press Journal checked four sample records from the listing and found the phone numbers valid. That shows those samples are real people, not where the data came from.
- Still unknown: whether SBI’s own systems were breached, or whether the data came from a vendor, a loan-lead partner or an agent. Whether the 3,897 records are 3,897 different people. What the 2,722 PDFs contain. How old the data is. Whether anyone has lost money because of it. The findings of the independent agency.
We have not found any report so far of money stolen using this data. We would say so if that changed.
The disclosure question
The Internet Freedom Foundation (IFF) wrote on 21 October that the filing was addressed to investors and said nothing about telling customers. It asked SBI to notify every affected person directly, to say how the data left the bank, and to confirm that anyone who loses money will be compensated under RBI rules. IFF also notes that the breach-notification duty in the Digital Personal Data Protection Act, 2023 is not yet in force (it gives May 2027), that RBI’s Advisory No. 3/2026 on customer data protection, dated 25 March 2026, recommends telling customers but is not binding, and that CERT-In’s 2022 directions require incidents to be reported within six hours. Two days later SBI said customers had been informed. We could not see the message itself, so we cannot tell you what it said.
Bank of Baroda told the exchanges of a similar incident on 27 July 2026 in almost the same words. It named a preliminary cause, “potential business email compromise”. SBI has named none.
Why leaked details become fraud
Leaked contact details are rarely used on their own. They are the first step in a call. In August 2025, Delhi Police arrested 18 people in a case in which, they said, customer data from a Gurugram call centre handling SBI card calls was passed to a gang. The gang called as bank staff, got OTPs and CVVs, and cheated card holders of about Rs 2.6 crore (PTI via The Tribune). That case involved insiders and card data, which is different from this leak, and we are not saying the two are connected. It shows what a believable caller can do with a customer list.
What SBI customers, and everyone else, can do
- Do not trust a caller because they know your details. Name, birth date, address and loan information are exactly what this kind of file holds. Hang up and call the number on your card, passbook or the bank’s official site.
- No genuine bank asks for your OTP, PIN, CVV or password. SBI repeats this in its own advice. Nor does it need you to install an app or share your screen.
- Be careful with loan calls. The reported fields include loan and lead data, so expect “pre-approved loan”, “document verification” or “processing fee” approaches. Do not pay anyone to release or process a loan.
- Our suggestion: if you get a message about the breach, do not click its link. Open the bank’s app or website yourself, or call the official number, to check. Fraudsters like to use a real news event.
- Switch on transaction alerts and check statements now and then. Report anything you did not do to the bank straight away.
- If money goes, call 1930 and file at cybercrime.gov.in without waiting. SBI’s cyber page, as quoted by The Hacker News, also lists report.phishing@sbi.co.in for phishing reports.
Nothing here means your own record was in the file. Only SBI can tell you that. Read our guides on digital-arrest calls, checking an urgent money request another way and festival-season payment scams, and the cases of a bank warning that stopped a large fraud in Sonbhadra and the Goa network of mule accounts.
Want to see what any website can read from your device without asking? Our page on what a website can learn about you shows it in your own browser.
What organisations should take from this
Tell the people whose data it is, early and in plain words, not only the stock exchanges. Say what fields were lost, what the person should watch for, and what the bank will do if money goes. Keep loan-lead and vendor data under the same control as core records, and treat dark-web monitoring alerts as an emergency from the first hour.
This page is general information, not legal or financial advice for your situation. We have not opened SBI’s exchange filing itself; the facts come from the reports listed in the sources. Last checked 27 October 2026.
- A BreachForums post claims 375,000 SBI customer rows and 2,722 PDFs; CyberPulse56 flags it on X; SBI gets alerts from its threat-intelligence provider, the Defence Cyber Agency and CERT-In
- Reports of the claim appear; SBI had not responded to media questions
- SBI files with the BSE and NSE: 3,897 customer records with personal information among about 3.75 lakh examined; Internet Freedom Foundation writes to SBI, RBI and CERT-In
- SBI says affected customers have been individually informed and that balances and funds are safe
- No finding on the source of the data and no loss to customers reported in the reports we read
Why consequences escalated
- SBI confirms a data-loss incident involving 3,897 customer records, found within about 3.75 lakh records on the dark web.
- The poster's claim is much larger (375,000 rows and 2,722 PDFs) and has not been confirmed by SBI.
- The alert reached SBI from outside: a threat-intelligence provider, the Defence Cyber Agency and CERT-In.
- The reported fields suit impersonation and loan scams; they do not include passwords, OTPs or card details.
- Five days passed between the alert and the exchange filing; customers were told after seven days, according to SBI.
- Whether any SBI system was breached, or the data left through a vendor or agent, is unknown.
Failures and risk multipliers
- Trusting a caller because they know your name, birth date, address or loan details.
- Sharing an OTP, PIN, CVV or password with someone claiming to be from the bank.
- Paying a "processing fee" or "document fee" to release a loan that you did not apply for.
- Clicking the link in a message about the breach instead of opening the bank's app or website yourself.
- Assuming that "no money was lost" means the leak is not your problem.
- For organisations: telling investors first and customers later, and treating loan-lead data as less sensitive.
Actions that reduce risk
- Hang up on unexpected "bank" calls and call back on the number on your card, passbook or the bank's official site.
- Keep transaction alerts on and read your statement now and then.
- Never share an OTP, PIN, CVV or password; do not install apps or share your screen at a caller's request.
- If money has gone, call 1930 and file at cybercrime.gov.in at once; report phishing to report.phishing@sbi.co.in.
- Check any breach notification by opening the bank's app yourself (our suggestion).
- Organisations: notify affected people early, in plain words, and protect vendor and lead data like core records.
Leave a comment