India’s largest lender, State Bank of India (SBI), has acknowledged that 3,897 of its customer records were discovered on the dark web. SBI has not yet verified the authenticity of these particular records or identified how they were exposed. The incident came to light via an official disclosure submitted to the stock exchange on October 21, 2026.
What Data May Have Been Exposed
The records reportedly revealed personal details including customers’ registered mobile numbers, dates of birth, names, gender, email and physical addresses, branch and CIF identifiers, and metadata tied to loan or lead files and other documents. The CIF identifier is SBI’s internal customer information file number. Crucially, the leak does notappear to involve sensitive financial credentials—such as account numbers, balances, passwords, or government-issued IDs like PAN and Aadhaar.
How SBI Discovered the Leak
SBI was alerted to the issue on October 16 by CERT-In (India’s national computer emergency response team) and the Defense Cyber Agency. In response, SBI activated its incident response protocols and hired an independent cybersecurity auditor from CERT-In’s approved panel to investigate the alleged breach.
SBI’s filing states that the bank does not yet know whether the exposed 3,897 records represent distinct individuals or whether additional records are involved. The overall set of data reportedly includes roughly 375,000 records circulating online.
Verification Efforts & Unanswered Questions
Threat intelligence researchers noted an online listing from a group called “Siriusim” claiming the leak of 375,000 CSV entries and 2,722 PDF documents tied to SBI customer data. Samples examined by journalists included loan papers, KYC data, and supporting documentation; some sample entries were confirmed to have valid phone numbers and images matching customer ID photos.
SBI has not yet confirmed whether the files posted online are part of what it found or whether the source of the data is an internal breach, a third-party provider, or some other angle. It has also not set a timeline for when the data was first leaked.
Impact & Response
The bank’s disclosure emphasizes that this event has not had a material impact on its core business operations, finances, or overall continuity. That said, the risk to customers remains: exposed personal data could enable impersonation, phishing attacks, or social engineering.
SBI’s public resources have yet to be updated specifically with information about affected customers, though general guidance remains in place directing users to report suspicious activity.
Notably, a similar incident occurred earlier this year at Bank of Baroda, where a third party claimed to have accessed customer data. The risk of exposure from external sources or supplier networks is becoming a recurring concern.
Why This Matters:bank customers require trust that their personal information remains secure, and a leak of metadata combined with personal identifiers can be exploited despite absence of financial credentials. Detection of such incidents—and timely disclosure—plays a major role in reducing downstream harm.
