SBI Investigates Suspected Dark Web Exposure of 3,897 Customer Records

The State Bank of India (SBI) has started an investigation after receiving alerts about the suspected exposure of 3,897 customer records on the dark web. The information may include personal details such as names, mobile numbers, dates of birth, email addresses, and home addresses.

According to SBI’s stock exchange filing, the bank received alerts on October 16, 2026, from its threat intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). During an initial review of around 375,000 records found on the dark web, SBI identified 3,897 records containing personally identifiable information (PII). This type of information can be used to identify a person.

The reportedly exposed data may also include customers’ gender, bank branch details, Customer Information File (CIF) identifiers, lead IDs, and information linked to loan records. However, the bank is still checking the data to confirm whether it is genuine and complete.

Following the alerts, SBI activated its cyber incident response and containment measures. The bank has also appointed an independent cybersecurity agency approved by CERT-In to investigate the suspected data exposure.

The agency will examine the available information to find out whether the exposed records are authentic, how the incident may have happened, and how much data could be affected. The investigation will also assess the possible risks to SBI and its customers. SBI said it is continuing its review and taking suitable steps to reduce risks and prevent similar incidents in the future. The detailed investigation is still underway, and the bank has not yet confirmed the full extent or source of the suspected exposure. Despite the reported exposure, SBI said the incident has had no major impact on its core banking operations, financial performance, or business continuity.

Customers should remain alert to unexpected calls, messages, and emails claiming to be from the bank. If personal information has been exposed, scammers may try to use it to make their messages appear genuine. Customers should never share their passwords, PINs, or one-time passwords (OTPs), and should contact SBI through its official channels if they notice suspicious activity.

The investigation will help establish the facts and determine what further action may be needed.

This article is based on information from News 18