SBI flags suspected dark web exposure of 3,897 customer records, launches probe

Mangalore Today News Network

New Delhi, Oct 21, 2026: State Bank of India (SBI) has launched an investigation into the suspected exposure of 3,897 customer records containing personally identifiable information (PII) on the dark web, including mobile numbers, dates of birth, email IDs and residential addresses.

The country’s largest lender said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure of customer data.

A preliminary analysis of about 375,000 records available on the dark web identified 3,897 SBI customer records containing personally identifiable information, the bank said in a filing with the stock exchanges.

The information reportedly included customers’ names, gender, registered mobile numbers, dates of birth, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs, and metadata associated with loan and lead records, along with other related files.

In its regulatory filing on Wednesday, SBI said, “On 16 October 2026, the Bank received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of the Bank’s customer data on the dark web. During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files."

SBI activates cyber incident response, appoints independent agency

SBI said it had initiated its cyber incident response and containment protocols and engaged an independent cybersecurity agency to investigate the nature and extent of the suspected data compromise.

“The Bank promptly activated its cyber incident response and containment protocols," SBI said in the exchange filing.

The lender added that the independent agency, empanelled with CERT-In, would conduct a comprehensive assessment to establish the authenticity and completeness of the exposed data, identify the potential source of the incident and determine its extent. The investigation will also assess the risks associated with the suspected exposure for both customers and the bank.

SBI said it was continuing its assessment and implementing appropriate remedial and preventive measures as required. The detailed investigation remains underway.

SBI says core operations, financial performance unaffected

The bank said the suspected data exposure had no material impact on its core business operations, financial performance or business continuity.

“We wish to submit that this does not have any material impact on Bank’s Core business operations, financial performance or business continuity," the filing said. “The Bank’s core business functions continue to operate normally without disruptions."

SBI said it was closely monitoring the situation and would take appropriate measures in accordance with applicable regulatory requirements as the investigation progresses.