State Bank of India disclosed an SBI data leak in an October 21, 2026 stock-exchange filing, saying it had identified 3,897 customer records containing personal information within a larger set of approximately 375,000 records available on the dark web, while its preliminary review had not established the authenticity of the data, the full scale of exposure, the risk to customers, the source of the information, or whether an SBI system had been breached.
Key Points
- SBI said it found 3,897 customer records with personal information in a larger dark web dataset of about 375,000 records.
- The bank said the finding is preliminary and has not confirmed whether the data is authentic or whether the records represent different customers.
- SBI received alerts on October 16, 2026, and activated incident-response and containment procedures.
- The bank said its core business functions continue to operate normally and the incident has no material impact on operations.
- Security experts warned that exposed personal and loan-related details could support phishing, vishing, identity fraud, or loan fraud.
What SBI Disclosed
State Bank of India, India’s largest state-owned bank, said the 3,897 records were found during a review of a larger set of approximately 375,000 records available on the dark web. SBI said the 3,897-record figure was preliminary.
The bank said the records represented approximately one in every 100 records reviewed. SBI said it had not determined whether the 3,897 records represented 3,897 different customers.
SBI’s filing did not identify an attacker, a cybercrime forum, a specific dataset, the source of the information, the date when the data first appeared, or whether an SBI system had been breached. The filing described the matter as “the alleged compromise.”
Response and Investigation
SBI said it received alerts about the suspected exposure on October 16, 2026, from its threat-intelligence service provider, India’s Computer Emergency Response Team, and the Defense Cyber Agency. The Defense Cyber Agency is the armed forces’ cyber agency under India’s Ministry of Defence.
SBI said it activated its incident-response and containment procedures after receiving the alerts. The bank engaged an independent cybersecurity firm from CERT-In’s panel of approved security auditors to investigate the alleged compromise.
According to SBI, the investigation is examining the data’s authenticity and completeness, identifying its potential source, determining the scale of exposure, and assessing risks to customers and the bank. SBI said the incident had no material impact on its core business operations, financial performance, or business continuity.
SBI stated that “the bank’s core business functions continue to operate normally without disruptions.”
Information in the Exposed Data
SBI said the data included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, and residential addresses. The bank also listed branch identifiers, customer information file identifiers, lead IDs, metadata associated with loan and lead records, and other related files.
A CIF identifier is SBI’s internal customer information file number. SBI’s listed categories did not include account numbers, account balances, passwords, one-time passcodes, card details, PAN numbers, or Aadhaar numbers.
SBI also acknowledged that the exposed information included names, genders, mobile numbers, email addresses, home addresses, dates of birth, bank profile IDs, loan metadata, and “other files.” Reporting based on sample documents indicated that the additional files included Central KYC numbers, video-KYC verification data, account-opening materials, loan-application documents, employment information, income declarations, employer details, work history, and salary information.
The Alleged Online Listing
An account using the name “Siriusim” claimed on the BreachForums cybercrime forum to possess SBI customer data, including personal information, new-account applications, loan applications, and supporting documents. The Siriusim listing claimed to contain 375,000 rows in CSV format and 2,722 PDF documents.
The claimed files included personal information, residential addresses, loan applications, account-opening forms, and supporting documentation. CyberPulse56 reported the alleged listing on X on October 16, 2026, stating that the dataset contained approximately 375,000 entries and 2,722 PDF files.
The Free Press Journal examined the BreachForums listing and reviewed four sample records. It found that the phone numbers in the four samples were valid, and that in one sample the WhatsApp profile photograph associated with a phone number matched the passport-size photograph in the person’s KYC document included in the listing.
The Free Press Journal said the reviewed samples were mostly loan-related and contained KYC fields. The samples did not establish whether the information came directly from SBI, one of its subsidiaries, or a third-party provider handling banking applications.
SBI’s filing did not link its analysis to the Siriusim listing. The filing also did not state whether the 2,722 PDF documents were included in the records SBI reviewed.
Fraud Risks
Independent security researcher Sushant Bhardwaj said, “If the data is genuine, the main risk is not direct account theft but credible-sounding phishing, vishing, and identity or loan fraud, since attackers who know someone’s details can impersonate the bank convincingly.”
Bhardwaj also said, “KYC details are hard to change, so they can support identity fraud, such as applying for credit in someone else’s name or answering account-verification questions.” He also said, “a caller who can quote real loan details can pose as the bank or a recovery agent and pressure a borrower into paying a ‘fee’ or sharing a one-time password (OTP).”
Brian Hussey, senior vice president for Cyderes’ Howler Cell, said his team had identified an Indian data broker selling personal records for approximately 5 rupees, or about six cents, per lookup through a Telegram bot and business-application-programming-interface platform. Hussey said, “A breach dump goes stale the day it’s posted. A live lookup service is always current, because it is asking the authoritative source in real time. India’s underground data market has both, and they work together.”
Hussey also said that reports had identified services in India that could use a mobile number to find a person’s identity, employment history, and registered vehicles. He said these searches could happen without leaving suspicious traces in the telecom provider’s logs or revealing who had requested the information. As he put it: “You cannot investigate an event that never registers as one.”
Hussey also warned, “India built one of the most connected identity systems in the world, and an entire industry exists to query it.” He added, “That connectivity is what makes a leak in one place so impactful and useful somewhere else.”
Customer Protection Steps
SBI’s cybersecurity guidance tells customers to report cyber incidents to report.phishing@sbi.co.in or India’s national cybercrime helpline at 1930. CERT-In advises customers to verify unexpected bank messages through official channels, avoid unfamiliar links, and never share PINs or one-time passwords.
Customers were advised to monitor their credit reports for unfamiliar loan accounts or credit inquiries and to report suspicious activity to the bank.
Sahdev Singh Tomar, founder of Tomar & Associates, said, “A data leak does not mean someone can walk away with a loan in your name, but it does make their job easier. Names, phone numbers and loan details help fraudsters sound like they are calling from the bank, and that is where people make the slip. So, check your credit report every few months for loans or enquiries you do not recognise.
Never share an OTP or PIN with anyone, even if the caller knows your account details. If something looks off, call the lender and report it on 1930. Acting early is what protects your money and your credit score.”
SBI’s investigation remains focused on confirming the authenticity and completeness of the data, identifying its source, determining the scale of the exposure, and assessing customer and bank risk. The bank said its core operations continue without disruption.
About the Author
