--- title: "SBI confirms customer data found on the dark web; 3,897 records held personal details" url: https://anawords.com/story/sbi-customer-data-dark-web-3897-records-what-to-do published: 2026-11-02T23:49:47+05:30 updated: 2026-11-02T23:49:47+05:30 section: AI in India author: Mayank Sahu checked: sources checked by AI, approved by editor version: 1 --- # SBI confirms customer data found on the dark web; 3,897 records held personal details The bank says no account numbers, passwords or card details were in the list it checked. Customers should watch for convincing fraud calls and never share an OTP. **In short:** State Bank of India told stock exchanges on 21 October 2026 that it had an incident involving loss of certain data, after CERT-In and the Defence Cyber Agency alerted it on 16 October. SBI found 3,897 customer records with personal details among about 3.75 lakh records on the dark web. State Bank of India told the stock exchanges on 21 October 2026 that it had "experienced an incident involving the loss of certain data", after an alert that customer records were for sale online.[^1][^2] The bank found 3,897 customer records with personal details among about 3.75 lakh records on the dark web.[^1][^2] SBI says the incident has no material effect on its business or finances.[^1] It has not said how anyone got hold of the data.[^1][^2] ## What was in the records The Hacker News lists the fields named in SBI's filing: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, and lead IDs tied to loan records.[^1] Account numbers, balances, passwords, OTPs, card details, PAN and Aadhaar are not on that list.[^1] The count is preliminary. SBI has not said whether 3,897 records means 3,897 different customers, and it has not confirmed that the data is genuine.[^1] ## How the bank found out CERT-In and the Defence Cyber Agency alerted SBI on 16 October, ThePrint and The Hacker News report.[^1][^2] A seller using the name "Siriusim" posted the data along with 2,722 documents that SBI has not verified.[^1][^2] SBI says it started incident response and brought in an independent cybersecurity firm from CERT-In's panel of auditors.[^1] ## Telling customers The order of disclosure drew criticism. SBI filed with the exchanges on 21 October, five days after the alert, and the Internet Freedom Foundation pointed out that investors heard before customers did.[^2] On 23 October, SBI said it had told affected customers by email and WhatsApp.[^2] ## What SBI customers should do The data on the list is the kind fraudsters use to sound convincing. A caller who knows your name, branch, date of birth and mobile number can seem like the bank. SBI's own guidance is to report cyber incidents to report.phishing@sbi.co.in or the national cybercrime helpline, 1930.[^1] Treat any call or message asking for an OTP, PIN or card number as fake, however much it knows about you. Banks don't ask for those. ## The AI angle ThePrint places the SBI incident alongside other October security problems in India and quotes STL Digital's Trivedi: "AI hasn't created new weaknesses. It has made the old ones cheap and fast to find."[^2] It also reports that RBI Governor Sanjay Malhotra said on 23 October that the RBI had alerted banks to AI agent risks.[^2] Nothing public so far suggests anyone used AI in this case. ## What to watch - The independent auditor's findings on how the data left SBI's systems. - Any guidance from RBI to banks on breach notification timing. Related: [eMudhra's weak certificate keys](/story/emudhra-weak-certificate-keys-exits-website-certificates-kpmg-review) and [TRAI's draft AI rules for telecom](/story/trai-draft-ai-guidelines-telecom-operators-risk-incident-reporting). ## Fact ledger - [Reported] SBI disclosed a data incident to stock exchanges on 21 October 2026, after an alert on 16 October. (source 1,2) - [Reported] SBI found 3,897 records with personal details among about 3.75 lakh dark web records. (source 1,2) - [Unconfirmed] The listed fields exclude account numbers, passwords, OTPs, card details, PAN and Aadhaar. (source 1) - [Unconfirmed] SBI said on 23 October it had told affected customers by email and WhatsApp. (source 2) - [Not known] How the data left SBI. ## Sources 1. [The Hacker News: State Bank of India confirms data leak after 3,897 customer records found on dark web](https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html) 2. [ThePrint: AI is making old flaws easier to exploit, SBI and eMudhra breaches expose gaps](https://theprint.in/india/ai-is-making-old-flaws-easier-to-exploit-sbi-emudhra-breaches-expose-gaps-in-indias-cyber-defences/3087680/)