SBI cyberattack: bank says 3,897 customer records on dark web

Key takeaways

• State Bank of India (SBI), the country's largest lender, told stock exchanges that a cyber incident led to 3,897 customer records with personal information appearing on the dark web, according to reports of its filing on October 21, 2026.
• The bank said those 3,897 records were identified in a preliminary review of roughly 375,000 records found online. A threat actor had claimed the larger set, plus 2,722 PDF documents, on a cybercrime forum since October 16.
• SBI said the incident is not expected to have a material impact on its core operations, financial performance or business continuity, and that it has hired an independent cybersecurity agency to assess the leak.
• Reports reviewed by Bullquill do not indicate that passwords, net banking credentials or UPI PINs were exposed. The authenticity, origin and full scope of the claimed dataset remain unverified.
• Indian rules require fast incident reporting to CERT-In (within 6 hours) and to the Reserve Bank of India. The breach-notification duties under the Digital Personal Data Protection (DPDP) framework are scheduled to take effect in May 2027.

What SBI has officially disclosed

State Bank of India (SBI) says a cyber incident exposed 3,897 customer records with personal information on the dark web, according to reports of its October 21 filing. The bank identified them in a preliminary analysis of about 375,000 records circulating online. For another recent case, see what leaked in the Capcom data breach.

According to the reports, SBI said it received alerts on October 16 about a possible exposure of customer data. The Sunday Guardian, describing the filing, listed three sources of those alerts: the bank's threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). India.com's account of the filing named the threat intelligence provider and CERT-In.

The data fields that SBI's preliminary review flagged, as reported by Reuters via Deccan Chronicle, include customer names, mobile numbers, dates of birth, email addresses, residential addresses, branch and customer identifiers, and loan-related records. Bullquill has not seen, and does not reproduce, any of the data.

The bank said it had activated its cyber incident response and containment procedures and engaged an independent cybersecurity agency to carry out a comprehensive assessment. It also stressed that the leak was "not expected to have any material impact" on its core business operations, according to the Reuters report. India.com quoted the filing as saying that core business functions "continue to operate normally without disruptions."

SBI has also been careful about what it has not confirmed. It said a detailed investigation is needed to establish whether the exposed data is authentic and complete, and to identify its source. The bank has not named any attacker and, in the reports reviewed, has not said how the records were obtained. Microsoft has also detailed how China-aligned Storm-0940 used the ARTEX AI pentesting tool against more than 2,250 tenants.

The larger claim circulating since October 16

The disclosure followed several days of online claims. On October 16, a cybersecurity account on X highlighted a post on BreachForums, a cybercrime forum, by a threat actor using the name "Siriusim," according to the Free Press Journal. The actor claimed to hold about 375,000 customer records in spreadsheet form and 2,722 PDF documents allegedly linked to SBI and possibly its subsidiaries. The material was described as including loan applications, supporting financial documents and know-your-customer (KYC) records.

The Free Press Journal reported that the actor posted a small number of sample records publicly and that phone numbers in those samples appeared to be valid. The outlet stressed that this does not prove the whole dataset is genuine, recent, or taken from SBI's own systems rather than a subsidiary or a third-party service provider.

The gap between the two figures matters. SBI's filing confirms personal information in 3,897 records; the claim on the forum refers to a dataset roughly 100 times larger. The bank's wording suggests the larger set was the pool it reviewed, not a confirmed count of affected customers. Until the independent assessment is complete, neither the full 375,000 figure nor the claimed PDF archive should be treated as established fact.

Sources: Reuters via Deccan Chronicle; India.com; Free Press Journal; Sunday Guardian.

What Indian rules require

CERT-In: six hours

Under directions issued on April 28, 2022 under section 70B(6) of the Information Technology Act, 2000, service providers, intermediaries, data centres, body corporates and government organisations must report specified cyber incidents to CERT-In within six hours of noticing them or being notified about them. The list of reportable incidents includes data breaches and data leaks. The directions took effect on June 27, 2022. In this case, CERT-In was itself reported to be among the bodies that alerted SBI, and the bank has not published the timing of its own report to the agency.

Reserve Bank of India

Banks also report to their regulator. The RBI's 2016 circular on a cyber security framework for banks asks lenders to report unusual cyber security incidents, whether successful or attempted, to the central bank within two to six hours, with follow-up updates as information develops. The RBI had not publicly commented on the SBI incident in the reports reviewed.

Securities disclosure

As a listed company, SBI is subject to the disclosure rules of the Securities and Exchange Board of India (SEBI), which require material events to be reported promptly to stock exchanges. Its October filing is the official channel through which the incident became public.

The DPDP Act and Rules

India's Digital Personal Data Protection Act, 2023 requires organisations to notify both the Data Protection Board and affected individuals of a personal data breach. The detailed procedure sits in Rule 7 of the DPDP Rules, 2025, notified in November 2025. That rule requires notice to the Board and to each affected person "without delay," followed by a detailed report to the Board within 72 hours. Under the phased rollout described by law firms including AZB & Partners, Rule 7 comes into force 18 months after notification, around May 2027. That means the full statutory breach-notification duty under the DPDP framework is not yet in effect for this incident, although other rules above already apply.

What customers can do

Because the reported fields include names, phone numbers and loan details, the most likely risk for affected people is targeted fraud, such as calls or messages that cite real personal details to appear legitimate. Standard precautions, consistent with guidance published by Indian banks and authorities, include:

• Never share OTPs, UPI PINs, card details or net banking passwords, even with someone who claims to be from SBI or a regulator.
• Treat unexpected calls about KYC updates, loan approvals or account blocks with suspicion, and call back using numbers listed on the bank's official website.
• Avoid clicking links or installing apps sent by message, and refuse requests to share your screen.
• Turn on SMS and email transaction alerts and check statements regularly.
• Use a strong, unique net banking password and keep phones and apps updated. Where your bank or email provider supports them, passkeys are harder to phish than passwords; our guide explains how to set up passkeys on iPhone, Android, Windows and Mac.
• Be careful about handing banking logins to third-party tools, including AI assistants. Some lenders now restrict this outright, as our report on US banks blocking AI agents from customer accounts explains.
• Report suspected fraud to the bank immediately, and to the national cybercrime helpline 1930 or the National Cyber Crime Reporting Portal (cybercrime.gov.in).

Context: a second state-run bank in three months

The SBI disclosure comes after Bank of Baroda, another state-run lender, said in July 2026 that customer data and internal documents had appeared on a dark web site. Reuters reported at the time that the bank linked the incident to a compromised employee email account and said its core banking systems had not been accessed. The two cases share a pattern: data surfaces first on a criminal forum, and the bank confirms a narrower scope while investigations continue. The problem is not limited to banks: in the United States, Quest Diagnostics said patient records were accessed in a breach of its Quanum systems.

What it means

For now, the confirmed facts are limited: SBI acknowledges that personal information from 3,897 customer records is exposed, says its core systems are running normally, and has commissioned an independent assessment. The much larger figure tied to the forum claim is unverified, and the origin of the data, whether SBI's own systems, a subsidiary or a vendor, has not been established.

The key open questions are whether the independent review changes the count, how the data left the bank's control, and whether SBI will contact affected customers directly. The case also highlights a gap in India's privacy regime: until the DPDP breach-notification rule takes effect in 2027, individual notification depends mainly on sector rules and the bank's own choices. Customers who receive unusual calls or messages that quote personal details should assume they may be fraud attempts and verify through official channels.

Related coverage

• PHP Sets Emergency Patches for Two Critical Flaws: What to Do Now
• HDFC Bank CEO exit: what is confirmed as governance questions mount
• India daily brief: Sensex, Nifty fall over 1% before Dussehra break

Sources

• Deccan Chronicle (Reuters): SBI reports cyberattack, 3,897 customer records exposed on dark web
• Business Standard: SBI reports cyberattack exposing 3,897 customer records on dark web
• India.com: SBI confirms data breach, core banking not affected
• Free Press Journal: SBI, subsidiaries' customer data allegedly on dark web
• Sunday Guardian: SBI confirms cyberattack as hacker group claims 3.75 lakh records
• CERT-In: official website and 2022 directions under section 70B(6)
• Linklaters: India's cyber security framework and breach reporting obligations
• Moneylife: RBI's cyber security framework for banks
• AZB & Partners: DPDP Act phased rollout and compliance milestones
• The Star (Reuters): Customer data from Bank of Baroda leaked online
• National Cyber Crime Reporting Portal