SBI Data Breach: 3,897 Records Exposed

SBI has reported a cyber security attack following an initial investigation, which revealed that there were 3,897 customer records with personally identifiable information available on the dark web.

However, SBI has confirmed that the core banking system, business performance, and continuity of the bank is not affected by this incident.

In a report issued on October 21, 2026, it has been stated that SBI had been alerted about the data breach on October 16 by its threat intelligence service provider, Defense Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In).

What Information Was Exposed?

SBI conducted an analysis on about 3.75 lakh data records available in the dark web and found 3,897 data records that had the personal information of their customers.

The information included in the leak included names, registered mobile phone numbers, date of births, gender, email addresses and address details. In some cases, the information was found to have branch codes, CIF numbers, lead ID and metadata from loan applications and related files.

However, the bank is yet to confirm whether all the 3.75 lakh data records belonged to individual customers of SBI.

SBI Launches Cybersecurity Investigation

As a result of this, SBI took steps for containing the breach through its cyber breach containment policies. SBI is also working with a cybersecurity agency that has been empanelled by CERT-In.

This will help understand the method behind the leak of information and the source of this leak as well as any kind of risk associated with customers and the bank.

Some preventive steps will also be taken by SBI to increase the security of their information technology framework.

What Should SBI Customers Do?

Disclosure of personal data might make people more vulnerable to phishing attacks, identity theft, and fraudulent phone calls. In such situations, criminals use legitimate personal information to make themselves look more trustworthy and convince people to provide confidential banking data.

It is essential not to provide OTPs, UPI PINs, ATM PINs, or any passwords even when communicating with those who say that they represent the bank. It is also necessary not to click suspicious links and check for suspicious correspondence from the bank through proper SBI channels.

Even though SBI has not yet reported any significant disruption in its main systems, it is important for customers to be on the alert for any suspicious account transactions and report the crime as soon as possible.