SBI data leak: 3,897 customer records found on dark web, bank probes
India's largest lender says personal details of 3,897 customers turned up in a dark web dump of about 375,000 records. Passwords and balances were not listed, but customers face a higher risk of phishing.
At a glance
- State Bank of India told regulators on 21 October that personal details of 3,897 customers were found on the dark web.
- The confirmed records came from a preliminary check of about 375,000 records offered online; the source and authenticity are still being verified.
- Exposed fields include names, mobile numbers, dates of birth, email and home addresses, branch and CIF identifiers, and loan-lead data — not passwords or account balances.
- Alerts came on 16 October from SBI's threat-intelligence provider, the Defence Cyber Agency and CERT-In; an independent CERT-In-empanelled firm is investigating.
State Bank of India (SBI), the country's biggest bank, has disclosed that personal details of 3,897 customers were found on the dark web. In a regulatory filing on 21 October 2026, the bank said the records were identified in a preliminary analysis of about 375,000 records offered online, and that an independent investigation is under way. SBI says account passwords and balances were not among the exposed data and that its business is not disrupted.
What SBI disclosed
| Item | Detail |
|---|---|
| Records checked so far | About 375,000 found on the dark web |
| Confirmed SBI customer records | 3,897 with personal information |
| First alert | 16 October 2026 |
| Who raised the alarm | SBI's threat-intelligence provider, the Defence Cyber Agency and CERT-In |
| Disclosure | Filing to regulators and stock exchanges, 21 October 2026 |
| Investigation | Independent CERT-In-empanelled cybersecurity agency |
| Business impact | None on business continuity, according to the bank |
The exposed fields include customers' names, registered mobile numbers, dates of birth, gender, email and home addresses, branch details, customer information file (CIF) numbers, lead IDs, and metadata linked to loan and lead records. The bank has stressed that the 3,897 records are what it has confirmed so far, not necessarily the full extent of the dump, and that the source and authenticity of the data have not yet been verified.
SBI said a detailed assessment is continuing and that remedial and preventive measures are being put in place.
Background
SBI serves hundreds of millions of customers across India, which makes it a constant target for fraudsters and cyber criminals. CERT-In, the Indian Computer Emergency Response Team, is the national agency that handles cyber incidents and requires organisations to report breaches quickly. The Defence Cyber Agency is the armed forces' cyber unit, and its involvement in the alert shows how widely the data was being watched.
India has seen a series of large data exposures in recent years, from telecom and health records to airline and e-commerce customers. Lead and loan data of the type listed in this case is often collected through marketing partners and loan sourcing agents, and investigators will look at whether the records came from SBI's own systems or from a third party.
The disclosure also comes in a week when businesses around the world are rushing to patch critical flaws in PHP, the programming language behind a large share of websites, after several governments took websites offline as a precaution.
Why it matters for customers
Even without passwords or balances, this kind of data is valuable to scammers. With a name, phone number, date of birth and branch details, fraudsters can pose convincingly as bank staff, send fake "KYC update" links, or try to trick people into sharing one-time passwords (OTPs).
How to protect yourself
- Never share your OTP, PIN, CVV or internet banking password with anyone, including callers who claim to be from SBI.
- Do not click links in SMS, WhatsApp or email messages asking you to update KYC or unblock an account; use only the official YONO app or SBI website.
- Keep SMS and email transaction alerts switched on and check them.
- Report any unauthorised transaction to the bank immediately and to India's cyber-crime helpline 1930 or cybercrime.gov.in.
- Be extra careful with loan offers that arrive out of the blue.
What happens next
The independent agency will report on how far the leak goes and where the data came from. SBI is expected to update regulators if more affected customers are found, and the Reserve Bank of India may seek details. Customers whose data was exposed may be contacted by the bank directly.
Questions people are asking
Was SBI customer data leaked on the dark web?
SBI said a preliminary analysis of about 375,000 records found on the dark web identified 3,897 records with personal information of its customers. The bank says the source and authenticity are still under investigation.
Is my SBI account money safe after the data leak?
According to the bank's disclosure, passwords and account balances were not among the exposed fields, and SBI says business operations are not affected. Customers should still watch for phishing calls and messages and report any unauthorised transaction immediately.
What data was exposed in the SBI dark web leak?
Names, registered mobile numbers, dates of birth, gender, email and home addresses, branch and customer information file (CIF) identifiers, lead IDs and metadata from loan and lead records.
