SBI confirms suspected dark-web exposure of 3,897 customer records in exchange filing
State Bank of India told stock exchanges it found 3,897 customer records with personal data on the dark web, after alerts from CERT-In, the Defence Cyber Agency and its threat-intelligence provider. The bank says core operations are unaffected.
State Bank of India (SBI) confirmed on Wednesday that it experienced an incident involving suspected exposure of customer data on the dark web, disclosing the finding in a stock-exchange filing, The Hindu BusinessLine reports (https://www.thehindubusinessline.com/money-and-banking/sbi-reports-suspected-exposure-of-customer-data-on-the-dark-web/article71606269.ece).
Preliminary analysis of approximately 375,000 records circulating on the dark web identified 3,897 customer records containing personally identifiable information, according to the filing. The exposed data reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan and lead records and related files.
SBI said it received communications on October 16, 2026 from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In, and promptly activated its cyber incident response and containment protocols. It has also engaged an independent CERT-In-empanelled cybersecurity agency to conduct a comprehensive assessment of the alleged compromise.
The bank said the incident has no material impact on its core business operations, financial performance or business continuity, and that core functions continue to operate normally. It added that a detailed investigation was still required to establish the authenticity of the exposed data and determine the source and extent of the exposure.
The disclosure follows an unverified claim by a threat actor using the name “Siriusim”, who posted on BreachForums that it held 3.75 lakh SBI customer records and 2,722 PDF documents — a claim flagged on October 16 by the X account CyberPulse56, according to YourStory (https://yourstory.com/2026/10/sbi-3897-customer-records-personal-data-dark-web-hacker-leak-claim). The Free Press Journal examined sample records and found the phone numbers were real. SBI has not confirmed the hacker’s claims; its filing covers only the 3,897 records its own analysis identified.
More on this topic: all Business stories
