SBI data incident: personal information found in 3,897 customer records
SBI says a preliminary review of roughly 375,000 dark-web records identified 3,897 customer records containing personally identifiable information.
AI-generated symbolic illustration; it is not a photograph of the actual incident. Production: MyNilgiris / OpenAI.
Update | October 22, 2026, 10:55 a.m. IST.
State Bank of India said in an official stock-exchange filing on October 21 that a preliminary review of roughly 375,000 records available on the dark web identified 3,897 customer records containing personally identifiable information.
The preliminary findings said the exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email and residential addresses, branch and CIF identifiers, lead IDs, loan-related records and associated metadata. SBI’s filing does not confirm that all 375,000 records were customer records; the confirmed number containing customer personal information is 3,897.
Steps reported by the bank
- SBI said it received an alert on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In about suspected customer-data exposure.
- Cyber-incident response and containment protocols were activated.
- An independent CERT-In-empanelled cybersecurity agency is assessing the source and extent of the exposure.
- SBI said there was no material impact on its core operations, financial performance or business continuity.
The investigation remains under way. The official filing does not say that customer account balances, OTPs or PINs were exposed.
Safety note for customers
Do not share an OTP, PIN, password, CVV or internet-banking credential with anyone. Ignore suspicious calls, messages and links claiming to be from SBI, monitor transactions and report concerns only through official SBI channels.
Clearly labelled sources
Image credit and disclosure
The featured image is a symbolic AI illustration generated with OpenAI. It is not a documentary photograph of the incident, a real bank system or any customer. Production: MyNilgiris.
