Full Breakdown
State Bank of India Confirms Dark-Web Exposure of 3,897 Customer Records
By Drooid · · How we work
Incident Overview
On October 21 2026, the State Bank of India (SBI) disclosed that a preliminary analysis of roughly 3.75 lakh records found on the dark web identified 3,897 customer records containing personally identifiable information (PII). The exposed data includes mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and loan-related metadata. SBI received alerts about the suspected exposure on October 16 2026 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In. The bank activated its cyber-incident response protocols and engaged an independent cybersecurity agency empanelled by CERT-In to investigate.
Background & Context
The breach emerges amid heightened regulatory focus on cybersecurity in India’s banking sector. Earlier in the year, the Reserve Bank of India tightened cyber-risk requirements for commercial banks, and CERT-In warned that AI-driven agents had accessed confidential data in several organisations. Recent incidents at other banks, such as a July data leak at Bank of Baroda, have underscored the sector’s vulnerability.
Data & Statistics
- Records examined on the dark web: ~375,000 (?3.75 lakh).
- Customer records flagged as containing PII: 3,897.
- Types of PII disclosed: mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, loan-related metadata.
Official Statements & Responses
SBI said the incident has no material impact on its core business operations, financial performance, or business continuity, and that core functions continue to operate normally. An independent CERT-In-empanelled cybersecurity agency has been tasked with a comprehensive investigation, and SBI affirmed that remedial and preventive measures are being implemented in line with regulatory requirements.
Conflicting Reports & Gaps
A hacker group calling itself “Siriusim” claimed on the dark-web forum BreachForums to possess around 3.75 lakh CSV entries and 2,722 PDF documents linked to SBI, including loan applications and account-opening forms. This claim was first reported by the cybersecurity account CyberPulse56 on X. The authenticity of the alleged dataset and the identity of the source remain unverified. SBI has not named any specific hacker group and continues to investigate whether the data originated from its own systems, a third-party service provider, or another source.
Verbatim Quotes
- “The danger is not just that someone has your data. It is that they can use it to make a fraudulent interaction look entirely legitimate,” — Sarthak Dubey, Co-founder and COO at Mitigata
What’s Next
SBI’s investigation will focus on three priorities: (1) confirming the authenticity, recency, and origin of the exposed data; (2) securing any compromised systems, revoking compromised credentials, and reviewing vendor access; and notifying potentially affected customers while strengthening fraud-monitoring mechanisms. The bank has pledged ongoing monitoring and compliance with applicable regulatory requirements as the assessment proceeds.