SBI said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure | Photo Credit: Reuters
State Bank of India is investigating the suspected exposure of 3,897 customer records containing personally identifiable information on the dark web, following alerts received from its threat intelligence service provider, the Defence Cyber Agency and CERT-In on October 16.
A preliminary analysis of around 3.75 lakh records available on the dark web identified 3,897 customer records containing sensitive information, including registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses, SBI said in the regulatory filing on Wednesday (October 21, 2026).
The exposed information reportedly also included branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and other related files.
It said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.
SBI said it had promptly activated its cyber incident response and containment protocols. It had also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the alleged compromise.
The incident has had no material impact on the bank's core business operations, financial performance or business continuity, the filing said, adding that its core business functions continued to operate normally without disruption.
A detailed assessment is underway, and appropriate remedial and preventive measures are being implemented, it said.
SBI added that it was closely monitoring the situation and taking all appropriate measures in accordance with applicable regulatory requirements.
Published - October 21, 2026 12:36 pm IST