SBI Confirms Dark Web Data Breach Exposing 3,897 Customer Records
State Bank of India, India's largest commercial bank, disclosed on October 21, 2026, that 3,897 customer records containing personal data were exposed on the dark web. The breach, identified from 375,000 scanned records, includes names, mobile numbers, and addresses. SBI engaged an independent agency for assessment, stating the incident has no material impact on core operations while regulators monitor the situation.
Key points
- State Bank of India, India's largest commercial bank, officially disclosed a data breach to stock exchanges on October 21, 2026, following alerts from the Defence Cyber Agency and CERT-In.
- Preliminary analysis of 375,000 records on the dark web identified 3,897 customer records containing Personally Identifiable Information, including names, mobile numbers, dates of birth, and residential addresses.
- The bank engaged an independent cybersecurity agency empanelled by CERT-In to investigate the source and extent of the compromise, while activating its internal cyber incident response protocols.
- SBI stated the breach does not materially impact its core business operations, though a detailed investigation is required to establish the authenticity and completeness of the exposed data.
- The disclosure occurred five days after SBI received initial communications regarding the suspected exposure, highlighting a multi-agency coordination between the bank, the Defence Cyber Agency, and the regulator CERT-In.
State Bank of India, the largest commercial bank in India, has confirmed that customer data was exposed on the dark web, marking a significant cybersecurity event for the country's banking sector. On October 21, 2026, the bank informed stock exchanges that 3,897 customer records containing Personally Identifiable Information were identified during a preliminary analysis of approximately 375,000 records available online. The exposed data includes sensitive details such as registered mobile numbers, dates of birth, names, gender, email addresses, and residential addresses, along with branch and CIF identifiers.
The incident came to light after SBI received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the regulator CERT-In. In response, the bank activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment. This independent review aims to determine the potential source of the leak, the extent of the exposure, and the associated risks to both customers and the institution.
SBI emphasized that the breach does not have a material impact on its core business operations, though a detailed investigation is still underway to establish the authenticity and completeness of the exposed data. The disclosure follows a five-day gap between the initial alerts and the formal announcement to the markets. As India's banking sector continues to digitize, this incident underscores the ongoing challenges in securing large-scale customer databases against dark web leaks, with regulators and analysts closely monitoring the outcome of the independent assessment.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
