The State Bank of India on Wednesday said that a cyberattack had led to the leak of about 3.75 lakh customer records on the dark web, of which 3,897 contained personally identifiable information.
The leaked information included customers’ names, mobile numbers, dates of birth, gender, email addresses and residential addresses, the bank said in a filing to the stock exchanges.
The bank said the leak was not expected to have any impact on its operations or financial performance.
An independent cybersecurity agency has been engaged to conduct an assessment and investigate the nature and extent of the data leak, the bank added.
Digital rights organisation Internet Freedom Foundation flagged that the bank had not notified the customers whose data was leaked and had only informed the stock exchanges.
The organisation also said that the bank had learnt of the breach from external agencies after the data had been published online and did not yet know how the data had left its systems.
Statement : SBI has told the stock exchanges about its data breach, but not the customers whose data was leaked
— Internet Freedom Foundation (IFF) (@internetfreedom) October 21, 2026
New Delhi, 21 October 2026
Today, the State Bank of India told the BSE and the National Stock Exchange, in a disclosure under Regulation 30 of the SEBI (Listing… pic.twitter.com/PdR0gwCwSp
It called...