State Bank of India has reported a data loss incident where approximately 3,897 customer records containing Personally Identifiable Information (PII) were identified on the dark web. The exposed data includes names, contact details, and other personal information. The bank has activated cyber incident response protocols and engaged an independent agency for a comprehensive assessment. The bank assures that core business operations remain unaffected, and remedial measures are being implemented.
SBI Reports Data Breach Incident
State Bank of India (SBI) has disclosed a data loss incident impacting a segment of its customer base. The bank was alerted on October 16, 2026, by its Threat Intelligence Service Provider and CERT-In regarding suspected exposure of customer data on the dark web. A preliminary analysis revealed approximately 375,000 records on the dark web, of which 3,897 customer records containing Personally Identifiable Information (PII) were identified.
Details of Exposed Information
The compromised data reportedly includes sensitive customer details such as registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch identifiers, CIF identifiers, lead IDs, and metadata associated with loan/lead records. A thorough investigation is underway to ascertain the authenticity and extent of the exposure.
Bank’s Response and Impact Assessment
In response, SBI has promptly activated its cyber incident response and containment protocols. An independent cybersecurity agency, empaneled by CERT-In, has been engaged to conduct a comprehensive assessment of the alleged compromise. The bank has stated that this incident does not have any material impact on its core business operations, financial performance, or business continuity. Core business functions continue to operate normally without disruptions.
Ongoing Measures and Reassurance
A detailed assessment is currently in progress, with appropriate remedial and preventive measures being implemented. SBI reassures stakeholders that it is closely monitoring the situation and taking all necessary actions in accordance with applicable regulatory requirements. The bank has informed the relevant authorities as required by Regulation 30 of SEBI (LODR) Regulations, 2015.
Source: BSE
