Data breach: SBI says it individually informed all affected customers

Regarding the recent data breach, State Bank of India on Friday (October 23, 2026) said that it had individually informed all the customers whose data were identified as being involved through email and/or WhatsApp.

In a statement, the SBI said “We reiterate that your account balances and funds are safe with us.”

“Customers are advised to follow safe digital banking practices, never share their OTP, PIN or password with anyone, and remain vigilant against suspicious calls, messages and emails,” it stated.

The country’s largest public sector bank had come under criticism for not informing affected customers though it intimated the incident to stock exchanges.

Earlier in the month, the SBI said it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of its customer data on the dark web, State Bank of India (SBI), India’s largest commercial bank, on Wednesday, October 21, 2026, informed stock exchanges about the incident involving the loss of certain data.

“During the preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified,” SBI told the exchanges as per SEBI disclose norms.

The exposed information included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files, it stated.

It said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.