Representative image. Pinakpani, CC BY-SA 4.0, Wikimedia Commons
Why it matters
SBI is India's largest bank, with more than 50 crore customers, so any leak of its customer data matters even when the number is small. Names, phone numbers, birth dates and addresses together let fraudsters make very convincing fake calls and messages in the bank's name. Customers should be extra careful with any request for an OTP, PIN or card details in the coming weeks.
The SBI data leak disclosed on 21 October 2026 involves 3,897 customer records that State Bank of India says were found on the dark web, the hidden part of the internet where stolen data is often traded. The country’s largest bank told the stock exchanges it is still checking whether the data is genuine and where it came from.
SBI said its services are running normally despite the SBI data leak and the incident has no material impact on its business. The filing does not say that passwords, PINs or one-time passwords were exposed, and no loss of money has been reported.
What the SBI data leak exposed
According to the bank’s filing, as reported by Business Standard, the records carry personal details that can identify a customer. The fields listed are names, gender, dates of birth, registered mobile numbers, email addresses and home addresses.
They also include internal bank references: branch details, CIF numbers (the customer information file number SBI gives each account holder), lead IDs and metadata linked to loan and lead records. Lead records are usually created when someone enquires about a loan or a product, so not everyone affected may be a current borrower.
SBI found the 3,897 records linked to the SBI data leak after going through about 3.75 lakh records posted online. That larger figure is a count of rows, not of people, and many rows can repeat the same customer. Put simply, about one in every 96 rows checked held personal information.
How State Bank of India found out
SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and CERT-In, the government’s computer emergency response team. That means five days passed between the first warning about the SBI data leak and the public disclosure on 21 October.
The bank said it switched on its cyber incident response and containment steps and hired an independent cybersecurity firm empanelled with CERT-In. That firm will check whether the data in the SBI data leak is authentic and complete, trace its source, measure how far it spread and judge the risk to customers and to the bank.
The filing does not name an attacker or explain how the data got out, and it does not say whether SBI’s core banking systems were breached. Separately, a group calling itself Siriusim has claimed online that it released 3.75 lakh rows of SBI data and 2,722 PDF files, Siasat reported. SBI has not confirmed that claim.
Why the SBI customer data leak has drawn criticism
The Internet Freedom Foundation, a digital rights group based in Delhi, said in a statement on 21 October that SBI had told the stock exchanges about the breach but had not said whether it informed the customers whose data was leaked. The group also pointed out that the bank learnt of the leak from outside agencies after the data was already public.
SBI has more than 50 crore customers, so the 3,897 records in this SBI data leak is a small share. For the people in that list, though, a name, phone number, birth date and address together are enough for a convincing fake call or message that appears to come from the bank.
The news came on a busy day for Indian markets. SBI shares were flat at about ₹970 on the BSE around 10 am, Siasat reported, and the stock is down about 12% over the past year. Earlier this week, another big issue, the Jio IPO, drew record demand, a reminder of how much personal and financial data Indians now share online.
What SBI customers should watch for now
After an SBI data leak like this one, leaked contact details are most often used for phishing, where fraudsters pose as a bank to get an OTP, PIN or card number. Banks and CERT-In have long warned customers never to share these with anyone, including callers who claim to be from SBI, and to ignore links in unexpected SMS or emails about blocked accounts or KYC updates.
Customers can check their account statements in the YONO app or at a branch for any payment they do not recognise, and report fraud on the national cyber crime helpline, 1930, or at cybercrime.gov.in. SBI has not yet said whether it will contact affected customers directly.
The independent agency’s findings on the SBI data leak will decide the next steps. SBI said it will put remedial and preventive measures in place and keep monitoring the situation. Any further update is likely to come through another stock exchange filing. For more on how India regulates online platforms, read our report on the High Court ruling on content blocking.
Frequently asked questions
How many SBI customers are affected by the data leak?
SBI said 3,897 records with personal information were found among about 3.75 lakh records on the dark web. The bank is still checking how many people that covers.
Were SBI passwords or OTPs leaked?
No. The fields SBI listed are names, gender, dates of birth, mobile numbers, email and home addresses, branch and CIF details, lead IDs and loan record metadata. Passwords, PINs and OTPs are not among them.
Is my money in SBI safe?
SBI said its services are running normally despite the SBI data leak and the incident has no material impact on its operations. No loss of money has been reported.
Where can I report a bank fraud call or message?
Call the national cyber crime helpline 1930 or file a complaint at cybercrime.gov.in, and inform your bank branch.