SBI Reports Suspected Exposure of 3,897 Customer Records on the Dark Web

State Bank of India (SBI), the country's largest lender, has disclosed a suspected exposure of customer data on the dark web, saying its preliminary analysis identified 3,897 customer records containing personally identifiable information. The disclosure, made in a stock exchange filing on October 21, 2026, marks one of the most significant suspected data incidents to hit an Indian public-sector bank — and it is already raising hard questions about how customer data is protected.

SBI said it received alerts about the suspected exposure on October 16 from three sources: its threat intelligence service provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In). The bank stressed that a detailed investigation is still underway to establish the authenticity and completeness of the data, determine the source and extent of the exposure, and assess the risks to customers.

What was found

According to the filing, SBI's preliminary analysis examined approximately 375,000 records circulating on the dark web. Of those, 3,897 records were found to contain personally identifiable information (PII). The exposed information reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, and residential addresses — along with branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and related files.

That combination of data is particularly sensitive. Mobile numbers plus dates of birth plus names are the raw material for identity fraud, phishing, and social-engineering attacks. The inclusion of loan-related metadata suggests the records may have originated from customer acquisition or lending workflows rather than core account systems.

SBI was careful to note that the number of records examined does not establish that 375,000 customers were affected — the confirmed PII count stands at 3,897, pending verification of authenticity.

How it surfaced

The disclosure follows claims made last week by a threat actor using the name "Siriusim." In a post on BreachForums, a site known for trading stolen data, the actor claimed to possess 375,000 customer records and 2,722 PDF documents linked to SBI. The claim was flagged on October 16 by the X account CyberPulse56, which tracks data-breach disclosures.

The listing described the data as a CSV file containing 375,000 rows alongside the PDF documents. The poster shared four sample records as purported evidence. The Free Press Journal examined the samples and found that the phone numbers were real. Most of the data appeared to relate to loans, while some entries concerned savings account applications and customer acquisition, according to YourStory's reporting. Inc42 noted it could not independently verify the claims.

SBI's response

SBI said it "promptly activated its cyber incident response and containment protocols" after receiving the alerts, and engaged an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive assessment of the nature and extent of the alleged compromise. The agency's job: verify whether the circulating records are genuine, trace where the data came from, and evaluate the security risks.

The bank maintained that the suspected exposure has had no material impact on its core operations, financial performance, or business continuity, and that banking services continue to function normally. SBI shares traded flat at around Rs 970 on the BSE on Wednesday morning, suggesting investors are — for now — treating the incident as contained.

Pressure for transparency is building. The Internet Freedom Foundation (IFF) called on SBI to inform every affected customer directly and without further delay, stating what data was exposed and what steps customers should take. Under India's data protection framework, notifying affected individuals is increasingly seen as a baseline expectation, not a courtesy.

The anatomy of a modern breach disclosure

The SBI episode follows a pattern that has become depressingly familiar in cybersecurity: a threat actor lists allegedly stolen data on a dark-web forum, independent researchers flag the listing, and the targeted organisation is forced into public disclosure before its own investigation is complete. The four sample records the "Siriusim" actor posted — with real phone numbers, per the Free Press Journal's checks — were enough to trigger alerts across India's cyber apparatus within days.

What stands out is the speed and seniority of the official response. Alerts came not only from SBI's own threat intelligence provider but from the Defence Cyber Agency and CERT-In — a sign of how seriously Indian authorities take incidents involving systemically important financial institutions. CERT-In's own critical warning earlier this month, after AI agents breached live systems at Indian organisations, has put the country's cyber establishment on high alert.

The loan-and-lead character of the data is a telling detail. Customer acquisition and lending workflows often involve third-party processors, marketing partners, and document-management systems — a wider attack surface than core banking platforms. If the exposure originated anywhere in that extended chain, the investigation will need to map data flows far beyond SBI's own servers. The bank's engagement of an independent CERT-In-empanelled agency suggests it is preparing for exactly that kind of forensic exercise.

There is also a regulatory dimension. India's data protection regime has been tightening expectations around breach notification — who must be told, how quickly, and with what level of detail. The IFF's demand for direct customer notification reflects a shift in norms: the era when institutions could investigate quietly and disclose minimally is ending. How SBI handles the notification question will be watched as a precedent for the entire banking sector.

Why it matters

SBI is not just any bank — it is India's largest lender, with hundreds of millions of customers and a central role in the country's financial system. A confirmed breach of its customer data would be among the biggest in Indian banking history, and the incident arrives at a moment of heightened sensitivity: CERT-In itself issued a critical warning earlier this month after AI agents breached live systems at Indian organisations, underscoring how fast the threat landscape is evolving.

The case also illustrates a now-familiar pattern in breach disclosures: a threat actor's dark-web listing, picked up by independent researchers, forcing a public reckoning before the victim organisation has completed its own investigation. SBI's framing — "suspected exposure," authenticity yet to be established — is legally prudent but will satisfy neither customers whose data may be circulating nor regulators watching closely.

For customers, the practical advice is unchanged but urgent: be alert to phishing calls and messages that reference personal details, do not share one-time passwords, and monitor accounts for unfamiliar activity. If SBI confirms the exposure, expect direct notifications and, most likely, regulatory scrutiny of how the data left the bank's control in the first place. Related reading: CERT-In's critical warning after AI agents breached live systems, the PHP2Shell emergency patch, and Meta pausing Muse chat sharing over exposed conversations.