State Bank of India (SBI), in its 21 October 2026 stock exchange disclosure, acknowledged a data loss incident and identified 3,897 customer records containing personal information during a preliminary examination of approximately 3.75 lakh records available on the dark web. The bank has engaged an independent CERT-In-empanelled cybersecurity agency to investigate the incident and stated that its core banking operations, financial performance and business continuity remain unaffected.
The State Bank of India (SBI) has officially disclosed an incident involving suspected exposure of customer information on the dark web, following recent media reports alleging a large-scale customer data breach.
In a regulatory filing dated 21 October 2026, submitted to the Bombay Stock Exchange (BSE) and National Stock Exchange (NSE) under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, SBI acknowledged an incident involving data loss and provided details of its preliminary findings.
According to the disclosure, approximately 3.75 lakh records were available on the dark web, of which 3,897 customer records containing personally identifiable information (PII) were identified during the bank's preliminary analysis.
SBI Received Cybersecurity Alerts on 16 October 2026
SBI stated that it received communications on 16 October 2026 regarding suspected exposure of customer information on the dark web.
The alerts were received from the bank's Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
Following these alerts, the bank initiated a preliminary examination of the reported data.
What Customer Information Was Exposed?
According to SBI's stock exchange disclosure, the information identified during the preliminary analysis reportedly included:
-
Customers' registered mobile numbers.
-
Names and dates of birth.
-
Gender and email addresses.
-
Residential addresses.
-
Branch and Customer Information File (CIF) identifiers.
-
Lead IDs and metadata associated with loan and lead records.
-
Other related files.
Such information is sensitive because it may potentially be misused for identity theft, impersonation, phishing and other financial fraud.
However, SBI has not confirmed that all 3.75 lakh records represent compromised customer accounts. The complete authenticity and extent of the exposure remain under investigation.
Independent Cybersecurity Investigation Initiated
SBI informed the stock exchanges that it promptly activated its cybersecurity incident-response and containment protocols.
The bank has also engaged an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive investigation.
The investigation will examine the nature and extent of the alleged compromise, the authenticity and completeness of the exposed data, its potential source and the associated risks to customers and the bank.
A detailed assessment is currently underway, and appropriate remedial and preventive measures will be implemented as required.
SBI Says Core Banking Operations Remain Unaffected
In an important clarification, SBI stated that the incident has not had any material impact on its core business operations, financial performance or business continuity.
The bank confirmed that its core business functions continue to operate normally without disruption.
SBI further assured that it continues to monitor the situation closely and take necessary measures in accordance with applicable regulatory requirements.
While banking operations remain unaffected, the investigation into suspected customer data exposure is still continuing.
Earlier Reports Alleged Exposure of 3.75 Lakh Records
The official disclosure follows media reports published during 19–20 October 2026 concerning claims by a hacker group about customer information allegedly associated with SBI.
Those reports referred to approximately 3.75 lakh data records and 2,722 PDF documents, potentially containing KYC details, account-opening documents and loan-related information.
The latest disclosure represents a significant development because SBI has now formally acknowledged the data loss incident and provided preliminary findings to the stock exchanges.
However, the bank has not conclusively established the full scale, authenticity or source of the suspected exposure.