Access a copy of SBI’s official statement here.
The State Bank of India (SBI) has confirmed that the personal details of 3,897 customers, including mobile numbers, dates of birth and home addresses, were found on the dark web among approximately 3.75 lakh other leaked records. SBI disclosed the incident to the BSE and the National Stock Exchange on October 21 in a filing mandated under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015.
The filing was made for investors’ benefit and states that the incident will have no material impact on the bank’s business. It does not mention whether SBI has informed the 3,897 affected customers about the data breach. The law requiring affected individuals to be notified will not take effect until May 2027.
What did SBI disclose?
The filing states that SBI received communications on October 16 from the Defence Cyber Agency, its threat intelligence service provider, and the Indian Computer Emergency Response Team (CERT-In) about “the suspected exposure of the Bank’s customer data on the dark web.”
- The records: In a preliminary analysis of approximately 375,000 records available on the dark web, the bank identified 3,897 customer records containing personally identifiable information.
- The details: The leaked information includes mobile numbers, dates of birth, names, gender, email addresses and residential addresses. It also includes branch and CIF identifiers (the Customer Information File number assigned by a bank to each customer), lead IDs and metadata linked to loan and lead records.
- The response: SBI said it had activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to investigate “the nature and extent of the alleged compromise.”
- The impact: SBI said the incident “does not have any material impact on Bank’s Core business operations, financial performance or business continuity.”
SBI said a detailed investigation was required to establish the authenticity and completeness of the data and “determine the potential source and extent of the exposure.” However, its filing does not specify what the remaining records contain. It also does not state whether SBI plans to investigate the contents of these records or whether the exposed material includes copies of identity documents such as Aadhaar, PAN or passports. The filing focuses on establishing the authenticity and completeness of the data and identifying the source of the exposure.
How did the claim surface?
On October 19, India Today reported that a threat actor using the name “Siriusim” had claimed on BreachForums, a dark web forum, to possess more than 3.75 lakh rows of data and 2,722 PDF files related to SBI customers. According to the report, the account CyberPulse56 was the first to flag the claim on X. On October 20, TimelineDaily reported that SBI had not yet officially responded. SBI’s filing does not mention the PDF files that the group claims to possess.
Who did SBI have to inform, and when?
The current rules governing disclosures to regulators, investors and customers are outlined below.
- CERT-In, within six hours: Under CERT-In’s directions issued on April 28, 2022, all organisations must report data breaches and data leaks to CERT-In “within 6 hours of noticing such incidents or being brought to notice about such incidents.” CERT-In’s FAQs allow organisations to report information “to the extent available at the time of reporting” and submit additional details later. In this case, CERT-In was one of the agencies that alerted SBI.
- The RBI, within six hours: The Reserve Bank of India’s (RBI) cybersecurity directions for commercial banks were issued on July 31, 2026. They require banks to report cyber incidents on the RBI’s DAKSH platform within six hours of detection.
- Investors: SBI submitted a filing under Regulation 30 of the SEBI LODR to the stock exchanges for investors.
- Customers: The Internet Freedom Foundation (IFF) has pointed out that data fiduciaries are required to notify the Data Protection Board of India and each affected individual about a personal data breach under Section 8(6) of the Digital Personal Data Protection Act, 2023. Rule 7 of the Digital Personal Data Protection (DPDP) Rules, 2025, provides further details on this requirement, as MediaNama has reported. However, the rule will take effect only on May 13, 2027.
SBI said it will take “all appropriate measures in accordance with applicable regulatory requirements.”
IFF has also highlighted that existing obligations primarily concern reporting to regulators and disclosures for investors, with no requirement for banks to notify affected individuals. It has called on SBI to inform every affected customer directly, explain what information was exposed and advise them on the steps they should take. IFF has also urged the RBI to direct entities under its jurisdiction to notify affected customers and called on the Ministry of Electronics and Information Technology to bring the relevant provisions of the DPDP Act and Rules into force immediately.
Has this happened before?
In July 2026, Bank of Baroda informed the stock exchanges about a data breach after a similar threat actor claimed to have accessed approximately 1 TB of its data, MediaNama reported. The bank described the incident as a “potential business email compromise” and, like SBI, said it did not expect a material impact on its operations, Teiss reported.
Questions we have sent
MediaNama has written to SBI, CERT-In and the RBI, and will update this story with their responses.
To SBI:
- What the remaining records in the approximately 3.75 lakh-record dataset contain, how many customers they relate to, and whether the dataset includes the 2,722 PDF documents claimed by the group, including loan applications, account opening forms or KYC documents such as Aadhaar, PAN and passport copies.
- Whether the exposed data originated from SBI’s own systems, a subsidiary, a vendor or a direct selling agent, and what the investigation has established about how the data left the bank’s systems.
- Whether SBI will publish a summary of the investigating agency’s findings once the investigation concludes.
- Whether SBI will establish a dedicated helpline and an online facility for customers to check whether their data was affected.
- Whether SBI will notify every affected customer directly by SMS, email and letter to their registered address, in English, Hindi and the language used by the customer’s branch, explaining what data was exposed and what steps customers should take.
To CERT-In:
- When it received SBI’s incident report, and whether it has issued any direction to the bank.
To the RBI:
- Whether its July 2026 directions require banks to inform customers whose data has been exposed, and whether it is examining this incident.
- Whether the RBI will direct all regulated entities to notify affected customers of personal data breaches within a fixed period, pending the commencement of the relevant provisions of the DPDP Act and Rules.
Also read:
- Companies to Notify the Data Protection Board of a Data Breach ‘Without Delay’ Under the DPDP Rules 2025
- DPDP Rules 2025 Mandate Encryption, Logs, and Timely Reporting in Case of Data Breaches
The post SBI confirms data of 3,897 customers exposed on dark web, silent on whether customers were informed appeared first on MEDIANAMA.