SBI dark web leak: 3,897 customer records exposed, bank tells exchanges
Why in the news
State Bank of India (SBI) informed the stock exchanges on 21 October 2026 that some of its customer data was suspected to be circulating on the dark web.
Key facts
- Alert date: SBI was warned on 16 October 2026 by its threat intelligence service provider, the Defence Cyber Agency and CERT-In.
- Scale: A first-level review of about 3,75,000 records found on the dark web showed that 3,897 customer records held personal information.
- Data involved: registered mobile numbers, dates of birth, names, gender, email IDs, home addresses, branch details, Customer Information File (CIF) identifiers, lead IDs and metadata linked to loan and lead records.
- Response: the bank triggered its cyber incident response and containment protocols and hired an independent agency empanelled by CERT-In to investigate.
- The probe will check whether the data is genuine and complete, trace its likely source and assess risks to customers and the bank.
- SBI said there was no material impact on its core business operations and that remedial and preventive steps were being taken.
| Item | Detail |
|---|---|
| Records found on dark web | About 3,75,000 |
| Customer records with personal data | 3,897 |
| Alerts received | 16 October 2026 |
| Disclosure to exchanges | 21 October 2026 |
About CERT-In
The Indian Computer Emergency Response Team is the national nodal agency for responding to cyber security incidents. It also empanels auditing and assessment agencies that organisations can hire after a breach.
Exam angle
- Listed companies must disclose material events such as cyber incidents to stock exchanges.
- Remember the two alerting government bodies: CERT-In and the Defence Cyber Agency.
- CIF is the unique customer identifier a bank uses across all accounts of a customer.