State Bank of India Confirms Cyber Incident: Dark Web Leak Exposes Details of 3,897 Customers

October 21, 2026

New Delhi: State Bank of India (SBI) has confirmed that 3,897 customer records containing personal information were found on the dark web. The bank said it received alerts about the suspected data exposure earlier this week and has started an investigation.

In a filing on Wednesday, October 21, SBI said it had received communications from its threat intelligence service provider, the Defence Cyber Agency and CERT-In, regarding the suspected exposure.

The bank said its preliminary analysis covered around 3.75 lakh records available on the dark web. Of these, 3,897 records were found to contain personally identifiable information (PII).

The exposed details reportedly included customers’ names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. Branch details, Customer Information File (CIF) identifiers, lead IDs and information linked to loan and lead records were also among the data identified.

SBI Begins Cybersecurity Investigation

SBI said it activated its cyber incident response and containment measures after receiving the alerts. It has also engaged an independent cybersecurity agency empanelled by CERT-In to examine the incident.

The investigation will look into whether the exposed information is authentic and complete. The bank is also trying to establish the possible source of the exposure and assess the risks associated with it.

SBI said the incident has had no material impact on its core business operations or financial performance. It added that its key functions continue to operate normally and that remedial and preventive measures are being taken.

Hacker Group Had Claimed Access to SBI Data

Earlier this week, a group using the name ‘Siriusim’ claimed to have obtained confidential information allegedly linked to SBI. The data was said to include customer details, loan applications and account-opening documents.

The claim was highlighted by the cybersecurity monitoring account CyberPulse56 in a post on X. According to that post, the group claimed to possess around 3.75 lakh data entries in CSV format and 2,722 PDF documents linked to the public sector lender.

SBI’s preliminary findings identified 3,897 records containing personal information among the larger set of records examined. The bank said its detailed investigation is continuing.

SBI Shares Trade Near Rs 970

SBI shares were trading almost flat at around Rs 970 on the BSE at about 10 am on Wednesday. Exchange data showed the stock’s 52-week high at Rs 1,234.80 and its 52-week low at Rs 891.55.

The stock had declined around 12% over the previous year, although it recorded gains over a five-year period.

The bank has not reported any disruption to its regular operations as a result of the incident. Its investigation is expected to establish the extent of the data exposure and the steps needed to address the risks.