SBI confirms customer data found on the dark web; 3,897 records held personal details
The bank says no account numbers, passwords or card details were in the list it checked. Customers should watch for convincing fraud calls and never share an OTP.
Illustration · not a photoIn short
State Bank of India told stock exchanges on 21 October 2026 that it had an incident involving loss of certain data, after CERT-In and the Defence Cyber Agency alerted it on 16 October. SBI found 3,897 customer records with personal details among about 3.75 lakh records on the dark web.
State Bank of India told the stock exchanges on 21 October 2026 that it had "experienced an incident involving the loss of certain data", after an alert that customer records were for sale online.12 The bank found 3,897 customer records with personal details among about 3.75 lakh records on the dark web.12
SBI says the incident has no material effect on its business or finances.1 It has not said how anyone got hold of the data.12
What was in the records
The Hacker News lists the fields named in SBI's filing: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, and lead IDs tied to loan records.1 Account numbers, balances, passwords, OTPs, card details, PAN and Aadhaar are not on that list.1
The count is preliminary. SBI has not said whether 3,897 records means 3,897 different customers, and it has not confirmed that the data is genuine.1
How the bank found out
CERT-In and the Defence Cyber Agency alerted SBI on 16 October, ThePrint and The Hacker News report.12 A seller using the name "Siriusim" posted the data along with 2,722 documents that SBI has not verified.12 SBI says it started incident response and brought in an independent cybersecurity firm from CERT-In's panel of auditors.1
Telling customers
The order of disclosure drew criticism. SBI filed with the exchanges on 21 October, five days after the alert, and the Internet Freedom Foundation pointed out that investors heard before customers did.2 On 23 October, SBI said it had told affected customers by email and WhatsApp.2
What SBI customers should do
The data on the list is the kind fraudsters use to sound convincing. A caller who knows your name, branch, date of birth and mobile number can seem like the bank. SBI's own guidance is to report cyber incidents to report.phishing@sbi.co.in or the national cybercrime helpline, 1930.1
Treat any call or message asking for an OTP, PIN or card number as fake, however much it knows about you. Banks don't ask for those.
The AI angle
ThePrint places the SBI incident alongside other October security problems in India and quotes STL Digital's Trivedi: "AI hasn't created new weaknesses. It has made the old ones cheap and fast to find."2 It also reports that RBI Governor Sanjay Malhotra said on 23 October that the RBI had alerted banks to AI agent risks.2 Nothing public so far suggests anyone used AI in this case.
What to watch
- The independent auditor's findings on how the data left SBI's systems.
- Any guidance from RBI to banks on breach notification timing.
Related: eMudhra's weak certificate keys and TRAI's draft AI rules for telecom.
Keep reading on this topic
AI in IndiaeMudhra quits website certificates after weak keys surface; Microsoft and browsers block its certificatesSafety & TrustMeta says attackers used an employee’s stolen login to copy code from some of its GitHub repositoriesAI in IndiaBengaluru inference startup Simplismart raises $14 million, with Nvidia as a strategic investorAI in IndiaTRAI proposes AI rules for telecom operators: risk ratings, an AI inventory and failure reporting More in AI in India →How this story was checked
- ResearchedWith AI assistance · 2 sources
- AI source checkEach sentence matched to its source
- Editor approvalMayank Sahu · 2 Nov, 23:49
- Published2 Nov, 23:49
Verify this story
- 2 sources, 0 official · 2 with an archived copy · see sources
- Every fact has a label and a source number · fact ledger
- What we searched, read and could not verify · research note
- Machine-readable: facts as JSON · text as Markdown
How this was made: researched, drafted and source-checked by AI (Claude, made by Anthropic), then published under the editor’s standing approval. A person did not read it line by line before it went live. AI policy
Fact ledger
How labels workTracked from this story
All trackersState Bank of India, Customer records · started not known · duration not published
All incidentsQuestions readers ask
Was my SBI account number leaked?
SBI's filing lists names, mobile numbers, dates of birth, addresses and branch details. Account numbers, passwords, OTPs and card details are not on the list.
What should SBI customers do?
Be wary of calls or messages that use your personal details, never share an OTP or PIN, and report incidents to report.phishing@sbi.co.in or the 1930 helpline.