The Sbi Data Breach Exposed 3,897 Customers

By Author: Teresa Joseph
Total Articles: 4
Comment this article

State Bank of India (SBI), the country’s largest lender, has confirmed that personal details of 3,897 customers were found on the dark web. The SBI data breach, disclosed to the stock exchanges on 21 October 2026, is one of the most significant cyber incidents at an Indian public sector bank this year. It has also exposed a gap in the law. The Digital Personal Data Protection Act, 2023, which was meant to give Indians a legal right to be told when their data is compromised, does not yet apply to breaches. Its key provisions take effect only on 13 May 2027.

Also Read: Inside the HDFC Bank Scandal That Triggered a Market Crash

For the customers caught up in the State Bank of India leak, that means there is no statutory requirement for the bank to inform them, no Data Protection Board to complain to, and no penalty under the data protection law that can be imposed on the bank.

What SBI Disclosed and When
According to SBI’s disclosure to the BSE and NSE under SEBI’s Listing Regulations, the bank received alerts on 16 October 2026 from its threat intelligence service provider, the Defence Cyber Agency ...
... and CERT-In, the government’s cyber emergency response team. The alerts concerned customer data that had surfaced on the dark web.

A preliminary review of approximately 375,000 records identified 3,897 customer records containing personally identifiable information. The exposed fields included names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch and customer identification (CIF) numbers, lead IDs and related metadata. SBI said the metadata was tied to loan or lead records.

SBI said it had activated its cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to investigate “the nature and extent” of the exposure. The bank said “a detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required.” It added that the incident had no material impact on its core operations, financial performance or business continuity.

On 23 October, SBI said in another update that it had individually informed customers whose data was identified as involved, by email and WhatsApp. It said customer balances and funds remained safe and urged customers not to share OTPs, PINs or passwords.

We investigate, document, raise awareness, support survivors, and push for real accountability — because silence protects the exploiters.