The State Bank of India (SBI) has confirmed a data loss incident involving the suspected exposure of customer information on the dark web. A preliminary assessment identified about 3.75 lakh records, including 3,897 customer records that contain personally identifiable information (PII).
The bank shared the details in a letter dated October 21, 2026, to the BSE and the National Stock Exchange (NSE). SBI said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). The alerts warned of the suspected exposure of customer data.
The exposed information reportedly includes customers’ registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. It also covers branch and customer identification details, lead IDs and metadata linked to loan and lead records, along with other related files.
SBI said a detailed investigation is needed to establish the authenticity and completeness of the exposed data. The probe will also determine the potential source and extent of the exposure and assess the risks to customers and the bank.
After receiving the alerts, the bank activated its cyber incident response and containment protocols. It also engaged an independent cybersecurity agency empanelled by CERT-In to examine the nature and extent of the suspected compromise. A detailed assessment is under way, and remedial and preventive measures are being implemented as required.
SBI said the incident had no material impact on its core business operations, financial performance or business continuity, and its core functions continue to run without disruption. The disclosure was made under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015. The bank said it would continue to monitor the situation and take appropriate measures in line with regulatory requirements.
