SBI Data Breach: Your Money May Be Safe, But What About Your Personal Information?

By Brajesh Kumar Tiwari

The reported exposure of personal information belonging to nearly 4,000 State Bank of India (SBI) customers on the Dark Web has raised fresh concerns about data security in India's banking system. Millions of Indians trust banks with their savings, salaries, pensions and financial transactions. But what happens when the institution entrusted with protecting their money cannot fully protect their personal information?

SBI identified 3,897 customer records containing personally identifiable information during a preliminary examination of approximately 375,000 records found on the Dark Web. The exposed information reportedly included names, mobile numbers, dates of birth, email addresses, residential addresses, customer identifiers, and loan related details. The bank received information about the suspected breach on October 16, 2026, and subsequently engaged an independent cybersecurity agency to investigate the incident.

SBI has maintained that customer balances remain safe and that its regular banking operations have not been materially affected. While this assurance is important, it should not end the discussion. The source and full extent of the data exposure remain under investigation.

Why Personal Information Matters as Much as Money

A data breach does not necessarily mean that money has been stolen from customers’ accounts. However, personal information can become a valuable resource for financial criminals. Consider a customer who recently applied for a home loan. If a fraudster obtains the customer’s name, telephone number, date of birth and loan details, making a convincing telephone call becomes much easier. The caller may pretend to represent the bank and demand an immediate payment for loan processing, account verification or updating 'know your customer' (KYC) information.

The customer may believe the caller because the person already knows information that would ordinarily be available only to the bank.

This is why protecting customer information cannot be treated as less important than protecting deposits. A bank account may remain financially secure today, but compromised information can expose its owner to fraudulent activities months later.

What RBI's Fraud Data Reveals

The larger banking picture deserves attention. According to the Reserve Bank of India’s (RBI) Annual Report 2025-26, banks and financial institutions reported 10,114 fraud cases involving Rs 48,021 crore during the financial year, as against 23,722 cases involving Rs 32,803 crore in the preceding year. These figures require careful interpretation. The 2025-26 total includes Rs 30,199 crore relating to 314 cases from previous financial years that were reported afresh following re-examination. Moreover, the amount involved in reported fraud cases does not necessarily represent actual financial losses. The figures cover different categories of banking fraud and should not be confused with data breaches alone.

Nevertheless, they demonstrate the continuing importance of stronger internal controls, effective supervision and timely identification of risks. As banking becomes increasingly dependent on digital platforms, customer information is distributed across multiple systems, including loan processing agencies, technology vendors, and outsourced service providers. Each additional point of access can create another security risk.

Lessons From The US: India is not alone in facing these challenges. In 2019, US banking company Capital One disclosed a major data breach affecting approximately 100 million individuals in the US and six million in Canada. In August 2020, the US Office of the Comptroller of the Currency imposed an $80 million penalty on Capital One for shortcomings in Information Technology (IT) risk management and internal controls.

The important lesson was not merely the size of the penalty. The regulator recognised that weaknesses in technology management could expose customers to serious risks and that banks must remain accountable for preventing such failures. Indian banking regulators should adopt an equally firm approach when investigations establish serious failures in data protection.

Europe's Approach to Data Protection: The European Union (EU) offers another useful example. Under the General Data Protection Regulation (GDPR), organisations must generally notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach that poses risks to individuals’ rights and freedoms. Where the breach creates a high risk, affected individuals must also be informed, subject to specified exceptions.

Europe has gone further through the Digital Operational Resilience Act (DORA), applicable since January 17, 2025. It requires covered financial institutions to strengthen their management of technology risks, operational resilience and oversight of external technology providers.

What Britain and Singapore Have Done Differently: The UK has introduced stronger protection against certain payment frauds. Since October 7, 2024, eligible victims of Authorised Push Payment scams have been entitled to mandatory reimbursement of up to £85,000, subject to the scheme’s conditions and exceptions. Singapore has introduced a Shared Responsibility Framework, effective December 16, 2024, under which banks and telecommunications companies have defined obligations to prevent specified phishing scams. Failure to fulfil those obligations can lead to responsibility for customers’ losses. These arrangements are not direct remedies for every data breach. They do, however, offer an important lesson: customer protection should not depend entirely on the customer’s ability to identify sophisticated fraud.

India’s Data Protection Framework Needs Effective Implementation

India has taken an important legislative step through the Digital Personal Data Protection Act, 2023, followed by the notification of the DPDP Rules in November 2025. However, several major provisions, including important data protection obligations, are being brought into force in phases, with many scheduled for May 2027. Existing CERT-In directions already require specified cyber incidents to be reported within six hours.

The next challenge is ensuring that regulatory compliance translates into meaningful customer protection. For a banking customer, it is not enough to know that an incident has been reported to the authorities. The customer should also understand what information was exposed, what risks may follow, and what action is necessary.

Reforms For Data Protection

The first reform should concern communication. Whenever a bank confirms a significant exposure of personal information, affected customers should receive direct notification through verified communication channels. In my view, India should aim for an initial customer notification within 24 hours of confirming a material breach, wherever sufficient information is available. Further details can follow as investigations progress. Banks should clearly explain the nature of the information compromised, possible risks, and necessary precautions. A dedicated helpline should be available so that customers can seek assistance without relying on suspicious messages or unfamiliar websites.

Second, banks should undertake regular independent cybersecurity assessments, especially of systems handling customer identification, loan applications, and digital banking records. Sensitive information should be protected through appropriate encryption, access restrictions, and continuous monitoring. Banks must also review how long they retain customer information and whether unnecessary records can be securely deleted. Particular attention should be given to third party vendors. Outsourcing data processing should never allow a bank to escape responsibility for customer privacy.

Third, the RBI should consider establishing a more comprehensive mechanism for sharing information about major cybersecurity incidents across regulated institutions. An attack affecting one bank can provide valuable warnings for others. Sharing technical findings, without revealing customers’ identities, would help prevent similar failures. Bank boards must also review cybersecurity risks regularly. A serious data breach should not be considered merely an IT department’s problem. Responsibility must extend to senior management and the board of directors.

 The RBI’s existing framework already provides nil liability for customers in certain unauthorised electronic banking transactions, including specified third party breaches reported within three working days of receiving the transaction alert. Separate protection applies when the fault lies with the bank. Unfortunately, many customers remain unaware of these provisions. Banks should communicate these rights more prominently and simplify complaint resolution.

Customers must also exercise caution by never sharing OTPs, Unified Payments Interface (UPI) PINs, or banking passwords. Suspicious transactions should be reported immediately to the bank and through the national cybercrime helpline, 1930. An important distinction must be understood: deposit insurance of up to Rs 5 lakh under Deposit Insurance and Credit Guarantee Corporation (DICGC) protects eligible deposits in specified circumstances. It does not automatically reimburse victims of every cyber fraud.

Trust Must Become the Real Measure of Banking Success

India has achieved remarkable progress in digital payments and financial inclusion. But the success of digital banking cannot be judged only by transaction volumes, profitability, or the number of customers served. The SBI incident should, therefore, be treated as an opportunity to examine weaknesses across the banking sector rather than merely as a question concerning one institution.

Banks hold far more than their customers’ money. They also possess information about their incomes, businesses, loans, family circumstances and financial behaviour. Protecting that information is an essential banking responsibility.

The future of Indian banking will depend not only on how efficiently banks manage people's money, but also on how responsibly they protect the personal information entrusted to them. Ultimately, customer trust is a bank’s most valuable asset, and once lost, it is difficult to recover.

The author is associate professor, Atal School of Management (ABVSME), Jawaharlal Nehru University, New Delhi, and author of the book, Changing Scenario of Indian Banking

(Disclaimer: Views expressed are the author’s own, and Outlook Money does not necessarily subscribe to them. Outlook Money shall not be responsible for any damage caused to any person/organisation directly or indirectly.)