Mumbai, October 21, 2026: State Bank of India (SBI), the country’s largest public-sector lender, has disclosed a cybersecurity incident involving the exposure of 3,897 customer records containing personally identifiable information on the dark web. The disclosure comes as financial institutions face growing threats from data theft and increasingly sophisticated cyberattacks.
SBI has appointed an independent cybersecurity agency to investigate the incident, assess the extent of the exposure and determine how the information was compromised.
3,897 Customer Records Reportedly Exposed
According to SBI’s preliminary assessment, the incident involves 3,897 customer records containing personally identifiable information.
The exposed data reportedly includes customers’ names, mobile numbers, dates of birth, email addresses and residential addresses. The bank is examining the incident to establish the full extent of the information involved.
Loan Records Also Among the Exposed Information
The compromised data reportedly includes customer identifiers, brand-related information and loan records.
The investigation will examine how the information was accessed and whether other customer data or systems may have been affected. The full scope of the exposure remains subject to further assessment.
Customer Information Found on the Dark Web
The discovery of customer information on the dark web prompted SBI to initiate an investigation.
The dark web is a part of the internet accessible through specialised software and networks. It is sometimes used by cybercriminals to publish, trade or sell information obtained through data breaches and unauthorised access.
The appearance of customer records in such an environment can increase the risk of targeted phishing attempts, identity misuse and fraudulent communications.
SBI Appoints Independent Cybersecurity Agency
SBI has engaged an independent cybersecurity agency to conduct a detailed assessment of the incident.
The review is expected to examine the possible source of the breach, the systems and processes involved, the nature of the exposed information and whether additional records were affected.
The findings could help the bank determine what further security measures or remedial steps may be necessary.
Core Banking Operations Reportedly Unaffected
SBI has indicated that the incident is not expected to have a material impact on its core business operations, financial performance or business continuity.
No disruption to normal banking services has been reported in connection with the disclosed incident. The bank’s investigation, however, remains important for establishing whether any wider risks exist beyond the exposure of customer information.
Earlier Hacker Claim Involved a Larger Number of Records
Before SBI’s disclosure, reports circulated about a hacker group’s claim that it had access to approximately 3.75 lakh SBI-linked records and 2,722 documents.
That broader claim had not been independently verified. SBI’s preliminary assessment identifies 3,897 exposed customer records, and the two figures should not be treated as equivalent or as confirmation of the larger allegation.
The ongoing investigation may provide greater clarity about the relationship, if any, between the reported claims and the incident disclosed by the bank.
Cybersecurity Risks Continue to Challenge Banks
The incident highlights the cybersecurity challenges facing India’s banking sector. Financial institutions remain potential targets for data theft, phishing, ransomware and other forms of cybercrime.
Even when core banking services remain operational, the exposure of personal information can create risks for customers and increase the possibility of fraud. Banks therefore need robust data protection measures, continuous monitoring and effective incident-response systems.
Investigation to Establish Full Extent of Exposure
The independent cybersecurity review will seek to determine whether the incident is limited to the identified records or whether additional customer information may have been compromised.
SBI has not publicly identified those responsible for the incident. Further details will depend on the investigation’s findings and any subsequent disclosures by the bank.
Customers Advised to Remain Vigilant
Customers should be alert to unexpected calls, emails, text messages or messaging-app communications claiming to represent SBI.
They should never share one-time passwords (OTPs), PINs, passwords or other banking credentials with anyone. Customers should also avoid suspicious links and verify requests through the bank’s official channels.
Although SBI has indicated that its core operations remain unaffected, customers should promptly report suspicious transactions or communications to the bank.
Source: Reuters, SBI, Moneycontrol
Supreme News Network
