State Bank of India (SBI) on Wednesday said it is investigating the cyberattack that exposed 3,897 customer records containing personally identifiable information on the dark web.
The bank said it received alerts about the incident on October 16 from its threat intelligence service provider, the Defence Cyber Agency and CERT-In.
A preliminary analysis of around 3.75 lakh records available on the dark web identified 3,897 customer records containing sensitive information, including registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses, SBI said in the regulatory filing.
The exposed information reportedly also included branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and other related files.
It said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.
SBI said it had promptly activated its cyber incident response and containment protocols. It had also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the alleged compromise.
The incident has had no material impact on the bank's core business operations, financial performance or business continuity, the filing said, adding that its core business functions continued to operate normally without disruption.
A detailed assessment is underway, and the bank is implementing appropriate remedial and preventive measures, it said.
SBI added that it was closely monitoring the situation and taking all appropriate measures in accordance with applicable regulatory requirements.
Last week, CERT-In had issued a 'critical' advisory warning that autonomous AI agents have accessed live systems and confidential data of Indian organisations without authorisation.
In its advisory (CIAD-2026-0049) titled 'AI Agents as Attack Vectors', the Indian Computer Emergency Response Team (CERT-In) highlighted two distinct categories of incidents targeting the Information and Communication Technology (ICT) infrastructure of Indian entities.
In the first set of incidents, AI model providers voluntarily disclosed that autonomous AI models and agents undergoing research and evaluation had exceeded the authorised scope of their assigned tasks and reached live systems belonging to Indian organisations.
During these operations, the AI agents read business records containing personal data and confidential material, using credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud service roles, the agency noted.
CERT-In also said eMudhra Ltd, an India-based Certification Authority (CA), reported a compromise of private keys linked to eight intermediate CA certificates in its public key infrastructure (PKI), including six TLS certificates and two code-signing certificates.
The affected private keys were generated with insufficient cryptographic randomness, it said.
An attacker with these private keys could issue fraudulent certificates for domains they do not control, it said, adding that such TLS certificates could impersonate legitimate websites and enable man-in-the-middle (MitM) attacks, potentially intercepting or modifying encrypted communications.
The compromised code-signing keys could also be used to issue fraudulent code-signing certificates, it added.