SBI finds 3,897 customer records in suspected dark web data exposure, begins investigation

SBI has identified 3,897 customer records with personal information in a suspected dark web exposure. Read what data was involved and what the bank is doing

PGurus Newsdesk

October 21, 2026

SBI says core operations are unaffected as it investigates the dark web exposure. Here’s the timeline and the bank’s response

3,75,000 Records Analysed, 3,897 Contain Personal Data: SBI Discloses Preliminary Findings

State Bank of India (SBI) has said it has identified 3,897 customer records containing personal information while analysing data suspected to have been exposed on the dark web. The bank has started a detailed investigation.

How the alert came

In an exchange filing on Tuesday, SBI said that on October 16 it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In, warning of a suspected exposure of customer data on the dark web.

What the preliminary check found

The bank’s preliminary analysis covered about 3,75,000 records available on the dark web. Of these, 3,897 contained personally identifiable information.

The exposed details reportedly include customers’ registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. The records also carried branch and customer information file (CIF) identifiers, lead IDs, and metadata linked to loan and lead records and other related files.

Investigation under way

SBI said a detailed investigation is needed to establish how authentic and complete the exposed data is, work out the likely source and extent of the exposure, and assess the risks to customers and the bank.

The bank said it quickly activated its cyber incident response and containment protocols after the alert. It has also engaged an independent cybersecurity agency empanelled by CERT-In to carry out a comprehensive assessment of the alleged compromise. That assessment is under way, and remedial and preventive measures are being put in place as required.

No impact on operations

SBI said the incident has no material impact on its core business operations, financial performance or business continuity, and that its core functions are running normally. It said it will keep monitoring the situation closely and act in line with applicable regulatory requirements.

For all the latest updates, download PGurus App.