Nearly 3,897 SBI Users’ Personal Data ‘Exposed’ on Dark Web; Eyes on Cryptic Post

The State Bank of India (SBI) on Wednesday admitted that the records of 3,897 customers, containing personally identifiable information (PII), are suspected to have been exposed on the dark web. The country's largest lender has launched a detailed investigation to verify the authenticity of the data, establish its source and determine the extent of the alleged exposure. In an exchange filing, SBI said it received alerts about the suspected data exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

A preliminary analysis of approximately 3,75,000 records found on the dark web identified 3,897 customer records containing personal information. The data reportedly included customers' names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. It also contained branch details, customer information file (CIF) identifiers, lead IDs and metadata linked to loan and lead records.

SBI said it had activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency empanelled by CERT-In to investigate the suspected breach. The agency will assess the authenticity of the data, determine the possible source and extent of the exposure, and examine the potential risks to customers and the bank.

The lender clarified that the incident had no material impact on its core business operations, financial performance or business continuity. It said its core banking functions continued to operate normally.

Break: SBI confirms data Leak of its customers. #SBI Data Leak. https://t.co/rgx15L7kv6

— Aseem Manchanda (@aseemmanchanda) October 21, 2026

What personal information was reportedly exposed?

The records identified during the preliminary analysis contained several types of information that could potentially identify customers. These included names, mobile numbers, dates of birth, gender, email addresses and home addresses. The dataset also reportedly contained customer information file (CIF) identifiers, which banks use to maintain customer information, along with branch details, lead IDs and metadata linked to loan applications and other related records.

The presence of such information could raise concerns about privacy and the potential misuse of customer data. Depending on the authenticity and completeness of the records, the information could potentially be used in targeted phishing attempts, fraudulent calls or other scams in which criminals pose as bank officials.

However, the precise nature of the risks will depend on what information was actually exposed and whether it can be linked to active customer accounts or applications. SBI's investigation is expected to establish these details. The bank said it was implementing appropriate remedial and preventive measures while the assessment continued.

What has the alleged hacker group claimed?

The bank's statement follows a claim by an unidentified hacker group operating under the name 'Siriusim' that it had obtained confidential customer information allegedly linked to SBI. The group reportedly claimed to possess personal details, loan applications and account-opening documents.

Cybersecurity monitoring account CyberPulse56 highlighted the claim in a post on social media platform X. According to the account, the group purportedly possessed around 3.8 lakh data entries in CSV format and 2,722 PDF documents associated with the lender.

The alleged dataset was said to contain customers' personal information, residential addresses, loan applications, supporting documents and other application-related records.

‼️DATA LEAK CLAIM — STATE BANK OF INDIA 🇮🇳 A threat actor identified as Siriusim claims to have leaked customer documents and personal data allegedly associated with the State Bank of India (SBI). 🎯 Target: State Bank of India (SBI) 🌍 Country: India 🇮🇳 🏦 Sector: Banking / Financial Services 📅 Claim reported: October 16, 2026 Claimed dataset: ▪️ 375,000 CSV rows ▪️ 2,722 PDF documents ▪️ Personal customer information ▪️ Loan applications and supporting documents ▪️ Account-opening applications ▪️ Address and other application-related details ⚠️ The threat actor describes this as the first disclosure of the dataset. The authenticity, origin and extent of the alleged exposure remain UNVERIFIED. Potential impact: If legitimate, the data could facilitate identity theft, financial fraud, targeted phishing and fraudulent loan applications. SBI should investigate the claim, verify whether customer records were exposed and notify potentially affected customers through official channels. #CyberSecurity #India #SBI #StateBankOfIndia #DataLeak #DataBreach #BankingSecurity #ThreatIntelligence

— CyberPulse (@CyberPulse56) October 16, 2026

CyberPulse56 first reported the claim on October 16, describing the material presented by Siriusim as its first disclosure of the dataset.

SBI's preliminary findings confirm that some records containing personally identifiable information were identified in the material examined on the dark web. However, the authenticity and origin of the alleged dataset, as well as the circumstances in which the information may have been exposed, remain under investigation.

SBI says business operations remain unaffected

SBI said the suspected exposure had not disrupted its core business functions or affected its financial performance. The bank also said its business continuity remained unaffected. "We wish to submit that this does not have any material impact on Bank's Core business operations, financial performance or business continuity. The Bank's core business functions continue to operate normally without disruptions," the lender said in its exchange filing.

The bank added that a detailed assessment was under way and that remedial and preventive measures were being implemented as required. SBI said it would continue monitoring the situation and take appropriate steps in line with applicable regulatory requirements. The independent cybersecurity agency's assessment is expected to help establish the scope of the incident and identify any further action required.

Cybersecurity concerns for India's banking sector

The suspected exposure comes amid growing concerns over cyber threats targeting financial institutions and the personal information they hold. Banks maintain large volumes of customer data, making the security of their systems and records a key concern for regulators and customers alike.

The incident also highlights the importance of distinguishing between the exposure of personal information and unauthorised access to banking systems or funds. SBI has said its core operations remain unaffected, but the investigation will need to establish whether the data is genuine, how it may have been obtained and whether customers face any specific risks.

Until the assessment is complete, the full extent and source of the alleged exposure remain unclear.

Recommended Precautions for Customers

• Be Vigilant: Do not share OTPs, PINs, or banking passwords with anyone—SBI officials will never ask for credentials via phone or email.

• Verify Communications: Double-check sender details on emails or SMS messages claiming to be from SBI.

• Monitor Accounts: Regularly review bank statements and report any suspicious transaction immediately.