SBI Confirms Cyberattack; 3,897 Customer Records Stolen, Leaked On Dark Web

The State Bank of India (SBI) has disclosed a cyberattack and data loss to stock exchanges after getting an alert related to the leak of customers’ data on the Dark Web. In a formal notification under the Securities and Exchange Board of India (SEBI) (Listing Obligations and Disclosure Requirements) Regulations, 2015, on October 21, 2026, SBI confirmed the incident and customers' data theft.

According to the filing, SBI was notified about the security concerns on October 16, 2026, from three entities, including its own intelligence service provider, Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). These notifications alerted the bank to a suspected exposure of customers’ data leak on the Dark Web.

While conducting a preliminary analysis of approximately 375,000 records found on the Dark Web, investigators identified 3,897 customers’ records that contained personally identifiable information (PII).

The bank said in a disclosure notification: “An independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise. We wish to submit that this does not have any material impact on the Bank’s Core business operations, financial performance or business continuity.”

What Data Has Been Exposed?

According to the SBI’s letter, the exposed datasets contained personal details, such as customers’ names, dates of birth, gender, residential address, registered mobile numbers and email addresses, along with other administrative identifiers, such as customer information file (CIF), lead IDs and metadata linked to loans and other related documents.

SBI said that it has activated its cyber incident response immediately after receiving the alert, and engaged an independent cybersecurity agency empanelled by CERT-In to investigate the incident further and find out the extent of vulnerability and data loss, and evaluate the risks to both customers and the bank.  

However, SBI has reassured the regulators and customers that the data leak has not disrupted its primary banking operations.

The bank said: “A detailed assessment is currently underway, and appropriate remedial and preventive measures are being implemented as required. We reassure that the Bank continues to monitor the situation closely and take all appropriate measures in accordance with applicable regulatory requirements.”

While the incident raises questions about digital security at the institutional level and how safe a customer’s personal details are, SBI has affirmed that the incident has not impacted its core business operations, financial performance, or business continuity. These functions will continue to operate as usual.