If you bank with SBI, you may have opened WhatsApp this week to find a message from the bank you never expected: your personal details were part of a data leak. For most of SBI’s huge customer base, nothing has changed. For a few thousand people, though, their name, phone number and loan details are now floating around the dark web, and scammers love exactly that kind of list.
Here is the short version. State Bank of India told the stock exchanges on October 21, 2026 that a cyberattack had led to customer records showing up on the dark web. Its early review found 3,897 records with personally identifiable information. After a digital rights group pointed out that customers had not been told, SBI said on Friday that it had contacted every affected person by email or WhatsApp, and that account balances and funds are safe.
Quick Facts
- Who: State Bank of India, the country’s largest lender
- What: Customer records leaked on the dark web after a cyberattack
- When: Alerts came in on October 16; disclosed to exchanges October 21; customers notified by October 23
- Where: Data offered on dark web forums
- Key number: 3,897 records with personal information, out of about 3.75 lakh rows the hackers claimed to have
What Happened in the SBI Data Breach
The trouble started around October 16. That is when SBI says it got warnings about a possible data exposure from three places: its own threat intelligence provider, the Defence Cyber Agency and CERT-In, India’s national cyber emergency team.
Around the same time, a hacker group calling itself Siriusim claimed it had about 3.75 lakh rows of spreadsheet data plus 2,722 PDF files from the bank, and said it was selling them. SBI has not confirmed who was behind the attack. It says it has not yet found the source.
When the bank went through the material, it found 3,897 records that contained personal details. It has brought in a CERT-In-empanelled security firm to check where the data came from and whether all of it is genuine.
What Customer Data Was Exposed
According to reports on the leaked records, the fields include names, registered mobile numbers, email addresses, dates of birth, gender and home addresses. Some entries also carry branch codes, CIF numbers and details tied to loan applications or sales leads.
What has not been reported is just as important. There is no sign that passwords, PINs, OTPs or card numbers were part of the leak. That is why SBI keeps repeating that money in accounts is safe. In its words to customers: “your account balances and funds are safe with us.”
The bank also told exchanges the incident had no material impact on its IT systems, core operations or finances.
Why Customers Weren’t Told at First
This is the part that annoyed a lot of people. SBI’s first public word on the leak was a stock exchange filing, written for investors. The Internet Freedom Foundation (IFF) publicly asked why shareholders heard about it before the people whose data was taken.
A day or so later, SBI said it had reached out to each affected customer individually through email and/or WhatsApp. It also said a detailed investigation is under way.
Indian Banks and the Rising Cyber Threat
SBI is not alone. In July, customer data and internal documents from Bank of Baroda also surfaced on the dark web. The Reserve Bank of India has warned lenders more than once that cyber risk could become a threat to financial stability.
The bigger worry is not the leak itself but what comes next. A list with your name, number, date of birth and loan details is perfect fuel for a scam call. Picture someone ringing you, reading out your exact loan amount and branch, and then asking you to “verify” an OTP. That call sounds very real.
What We Don’t Know Yet
- How the attackers got in, and whether a vendor or partner system was involved
- Whether the hacker group’s claims about 3.75 lakh rows and 2,722 PDFs are accurate
- What was inside those PDF files
- Whether any regulator will penalise the bank
What This Means for You: Simple Safety Steps
Whether or not you got a message from SBI, a few habits will protect you:
- Never share OTP, PIN or password. No real bank employee will ask for them, ever.
- Be suspicious of callers who “know” you. Knowing your loan or branch details does not prove they are from the bank.
- Don’t click links in SMS or WhatsApp claiming your KYC is pending or your account is blocked.
- Turn on transaction alerts and check your statement regularly.
- If money goes missing, call the national cyber fraud helpline 1930 or report at cybercrime.gov.in right away. Speed matters.
Our Take
Nearly 3,900 people is a small slice of SBI’s customers, and the bank seems to have acted once it was pushed. But the order of events matters. Telling investors first and customers later sends the wrong message about who a bank answers to. The people whose phone numbers are now on a hacker forum deserved the first call, not the second.
FAQs
Is my money in SBI safe after the data breach?
SBI says account balances and funds are safe. There are no reports that passwords, PINs or card details were leaked.
How do I know if my SBI data was leaked?
SBI says it has contacted every affected customer by email and/or WhatsApp. Be careful: scammers may send fake “breach” messages too, so don’t click links in them.
How many SBI customers were affected?
SBI found 3,897 records with personal information. The hackers claimed to hold about 3.75 lakh rows of data in total.
Who hacked SBI?
A group called Siriusim claimed responsibility, but SBI has not confirmed who was behind it. An investigation is ongoing.
Should I change my SBI password?
Passwords were not reported as leaked, but changing yours and turning on alerts is a sensible, low-effort precaution.
Based on reporting by Scroll, The Hans India and the Internet Freedom Foundation.
Leave a Reply