The suspected SBI data leak has affected a very small number of customers, State Bank of India said in an assurance published on October 23, 2026, adding that customer balances remain completely safe. The bank said the incident had no material impact on its IT systems, core business operations, financial performance or business continuity, while an investigation into the suspected exposure continued.
Key Takeaways
- A preliminary review of approximately 375,000 dark-web records identified 3,897 customer records containing personally identifiable information.
- SBI says customer balances are safe, but the authenticity, source and full extent of the exposed data remain under investigation.
- The bank activated incident-response protocols and engaged an independent cybersecurity agency to assess the alleged compromise.
Table of Contents
- SBI data leak inquiry separates data exposure from balance safety
- Alerts prompted containment and an independent assessment
- Customer precautions remain relevant while findings are pending
- Conclusion
SBI data leak inquiry separates data exposure from balance safety
SBI disclosed the suspected exposure of customer data on the dark web in an October 21 exchange filing. Its subsequent assurance addressed the safety of customer money and the continuity of banking services, rather than announcing that the data investigation had been completed.
The distinction matters: the bank’s statement that balances are safe does not resolve questions about the exposure of personal information. SBI said further investigation was needed to establish the authenticity and completeness of the data, identify its potential source and determine the risks to customers and the bank.
The 3,897 customer records identified in the preliminary analysis are not the same as the approximately 375,000 records reviewed. The larger figure describes the material examined, not a confirmed count of affected customers.
| Item | Details |
|---|---|
| Contact information | Reportedly exposed fields included registered mobile numbers, email addresses and residential addresses. |
| Personal information | Names, dates of birth and gender were among the fields described. |
| Banking and lead identifiers | The disclosure listed branch and CIF identifiers, lead IDs, and metadata linked to loan or lead records. |
Alerts prompted containment and an independent assessment
SBI received communications on October 16, 2026, from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In. The bank said it promptly activated its cyber incident response and containment protocols.
An independent CERT-In-empanelled cybersecurity agency was engaged to investigate the nature and extent of the alleged compromise. SBI said a detailed assessment was underway and that remedial and preventive measures were being implemented as required.
The information described in the disclosure extended beyond contact details to identifiers and metadata associated with loan or lead records.
Customer precautions remain relevant while findings are pending
Separately from the incident investigation, SBI’s customer cybersecurity guidance advises users not to share one-time passwords, ATM PINs or card verification codes over the phone, and to verify a caller’s identity. That standing guidance explains precautions against impersonation; it does not establish the cause or outcome of this incident.
The bank’s cybersecurity page also directs customers to report cyber incidents through the cybercrime helpline, 1930. SBI said it continued to monitor the situation and would take appropriate measures in line with applicable regulatory requirements.
Conclusion
The next issue to watch is the outcome of SBI’s ongoing assessment: whether it establishes the data’s authenticity, the source and extent of the exposure, and any further measures needed to protect customers.
Read More News
Disclaimer
This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.
