Privacy
State Bank of India investigates data leak after 3,897 customer records found online
State Bank of India is investigating a data leak after thousands of customer records appeared on a cybercrime forum. The bank says it is still checking the source and scale of the breach.
Ross Grant3 min read
The short version
State Bank of India has found thousands of customer records for sale on the dark web. The bank is still investigating where the data came from and how many people are affected. The leaked information could be used for scams, so customers should be cautious about suspicious messages or calls.
By the numbers
- 3,897customer records identified in the leakThe Hacker News
- 375,000total records found in the dark web datasetThe Hacker News
- 2,722PDF documents claimed to be leakedThe Hacker News
What happened?
State Bank of India has confirmed it is investigating a data leak after 3,897 customer records were found on the dark web. The bank says it does not yet know the source or scale of the breach and is working with cybersecurity experts to assess the risk.
What is known about the SBI data leak
State Bank of India (SBI), the country’s largest bank, has confirmed it is investigating a data leak after 3,897 customer records containing personal information were found among about 375,000 records on the dark web. The bank disclosed the incident in a stock-exchange filing on 21 October 2026. SBI said it does not yet know where the data came from, whether it is genuine, or the full extent of the exposure.
The alert first reached SBI on 16 October, when its threat intelligence provider, along with India’s national computer emergency response team (CERT-In) and the Defence Cyber Agency, flagged the listing. The bank then activated its incident response procedures and brought in an independent cybersecurity firm from CERT-In's approved list to investigate.
What information was exposed
According to the bank’s filing, the exposed records reportedly include customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers (the bank’s internal customer ID), lead IDs, and metadata linked to loan or lead records. No account numbers, balances, passwords, one-time passcodes, card details, or government ID numbers (such as PAN or Aadhaar) were listed among the exposed data.
The main risk with this type of information is impersonation. Attackers could use these details to make phishing calls or send messages that appear to come from the bank, potentially tricking customers into sharing sensitive information or making payments.
What is still unclear
SBI has not said whether the 3,897 records belong to 3,897 different people or if some are duplicates. The bank also has not confirmed whether the rest of the 375,000 records are genuine or what they contain. The source of the data remains unknown. It is not clear if the data came from SBI itself, one of its subsidiaries, or a third-party provider. The bank’s filing does not mention if any SBI system was breached or when the data first appeared online.
A threat actor using the name Siriusim claimed to have leaked 375,000 rows of data and 2,722 PDF documents, including personal information, loan applications, and supporting documents. The Free Press Journal reviewed four sample records from the listing and found that the phone numbers were valid and matched WhatsApp profile pictures to KYC documents. However, this check only covered four records and does not confirm the authenticity of the full dataset or its origin.
How SBI is responding
SBI says the incident has no material impact on its core business operations, financial performance, or business continuity. However, this statement refers to the bank’s business, not its customers. The bank has not said whether affected customers have been or will be notified. Its website advises customers to report any cyber incident to a dedicated email or the national cybercrime helpline, but this advice predates the current incident.
What customers should do
If you are an SBI customer, be alert for suspicious calls, emails, or messages that claim to be from the bank and ask for personal or financial information. SBI will never ask for your password, PIN, or OTP over the phone or by email. If you suspect a phishing attempt, report it to SBI at report.phishing@sbi.co.in or call the national cybercrime helpline on 1930.
Context: similar incidents
The language in SBI’s stock-exchange filing is similar to a recent disclosure by Bank of Baroda, another state-owned bank, which reported a cyber-security incident in July after receiving a tip-off about a possible data compromise. In that case, the preliminary cause was a potential business email compromise, but SBI has not named any cause so far.
Claimed vs confirmed
- Unconfirmed
A threat actor named Siriusim leaked 375,000 rows of SBI customer data and 2,722 PDFs.
CyberPulse56 flagged the claim on X; SBI has not confirmed the full dataset or its source.
- Unconfirmed
The leaked data is genuine and belongs to SBI.
The bank is still verifying the authenticity and origin of the data.
The impact
- Money
- SBI says the incident does not affect its core business or financial performance. However, under Indian law, regulators could investigate and impose penalties if customer data was mishandled.
- Reputation
- The leak could damage trust in SBI, especially if more records are confirmed or if customers are targeted by scams.
- Customers
- Customers face a risk of phishing or impersonation attacks using their personal details. They should be cautious about any unexpected messages or calls claiming to be from the bank.
Why it matters
Personal information from a major bank can be used for scams and identity theft. Even if account numbers and passwords were not exposed, details like names, phone numbers, and addresses can help criminals trick people into revealing more sensitive information.
How does it work?
Attackers often post stolen data on cybercrime forums to sell or trade. The data in this case reportedly includes personal details that could be used for impersonation or phishing, but does not include passwords or account numbers. The exact method of the leak is not yet known.
Key points
- SBI is investigating a data leak involving 3,897 customer records.
- The exposed data includes personal details but not account numbers or passwords.
- The bank does not yet know the source or full scale of the breach.
- Customers should watch for phishing attempts using their personal information.
- SBI has not confirmed if customers will be notified directly.
Sources
The Hacker News
Reference
