SBI tells customers identified in dark web leak their funds are safe

SBI says identified customers were contacted

State Bank of India said on 23 October 2026 that it had individually informed all customers whose data was identified as involved in the dark web leak through email and/or WhatsApp. In a statement shared on X, the bank said account balances and funds remained safe. It advised customers not to share OTPs, PINs or passwords and to stay alert to suspicious calls, messages and emails. MorungExpress reported the statement on 23 October, citing IANS.

The statement followed a 21 October post by the Internet Freedom Foundation, which said SBI had told the BSE and National Stock Exchange about the breach but not the customers whose data was leaked. ETV Bharat cited the post. TechObserver noted that SBI's exchange filing did not mention whether affected customers had been notified or would be informed.

Filing put identified records at 3,897

SBI's 21 October 2026 exchange filing said a preliminary analysis of about 375,000 records on the dark web identified 3,897 customer records containing personally identifiable information. The bank said the incident had no material impact on core business operations, financial performance or business continuity. It said core functions continued normally.

The filing listed exposed categories: registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. It also listed branch and customer information file identifiers, lead IDs and metadata tied to loan and lead records. It did not list passwords, PINs or one-time passwords, and did not report stolen funds.

A CIF identifier is a unique number banks use to keep a customer's consolidated relationship and account information, The Times of India reported. Lead IDs typically identify prospective customers or applications in sales and lending processes.

375,000 is records reviewed, not a victim count

The 375,000 figure is the size of the dataset SBI reviewed, not a count of customers. Record counts can include repeated entries and do not necessarily represent separate people, CyberSecurityNews reported. SBI called the 3,897 figure preliminary. TechObserver reported that the identified records represent roughly one in 100 of the records examined. SBI has not said whether the 3,897 records belong to 3,897 different individuals, or what the remaining records contain, according to TechObserver and Arab Times.

In a public notice to customers, SBI said the incident had impacted "a very, very small number of customers" without giving a figure, IBTimes reported.

What was exposed and what it means

CyberSecurityNews reported that branch details and loan references could help fraudsters make fake banking calls sound credible. Arab Times reported that the exposure raises concerns about identity misuse, impersonation and targeted fraud, particularly if criminals use genuine details to pose as bank officials. Account numbers, balances, card details and government identity numbers such as PAN or Aadhaar are not among the categories the filing lists, TechObserver reported.

The filing did not identify an entry point, an exploited vulnerability, a malware family or a compromised server.

SBI's response and open questions

SBI said it received alerts on 16 October 2026 from its threat intelligence service provider, the Defence Cyber Agency and CERT-In about suspected exposure of customer data on the dark web. It said it activated cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In. The investigation is meant to establish the authenticity and completeness of the data, find its source and extent, and assess risks to customers and the bank. Remedial and preventive measures were being implemented, and SBI said it would continue to monitor the situation and act under applicable regulatory requirements.

The Defence Cyber Agency is the armed forces' cyber unit under the Ministry of Defence, TechObserver reported.

The filing names no attacker, forum or dataset. Before the filing, a threat actor using the name Siriusim claimed to have leaked 375,000 CSV rows and 2,722 PDF documents allegedly linked to SBI, CyberPress reported on 16 October 2026. The claim was flagged by monitoring account CyberPulse56. SBI's disclosed findings do not attribute the incident to a named attacker. The bank has not established how the information was obtained or whether attackers breached its core banking systems. It has not said whether the records came from SBI itself, a subsidiary or a third-party processor, TechObserver reported. The filing also leaves the source of the data to the investigation and gives no date for when it first appeared, TechObserver said.

TechObserver reported that the Free Press Journal examined four sample records on BreachForums and found valid phone numbers; one WhatsApp profile picture matched a passport photograph on a KYC document posted with the listing. That check covered four records and did not establish that the entire dataset was genuine or where it originated.

The investigation is ongoing.