The story so far: Public Sector bank State Bank of India (SBI), the country’s biggest commercial bank with 53 crore customers — meaning every third Indian is an account holder — and a FY26 net profit of over ₹80,000 crore, informed stock exchanges on Wednesday (October 21, 2026), about a customer data breach on the Dark Web. The incident was reported on October 16, 2026, but SBI admitted the breach only after five days.
What did SBI say in stock exchange filing?
In a stock exchange filing, SBI said it had experienced an incident involving the loss of certain data. It stated that on October 16, 2026, it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert about the suspected exposure of its customer data on the dark web. While it did not yet know where the data came from, SBI said it had engaged a CERT-In–empanelled agency to investigate.
The Internet Freedom Foundation said that SBI did not detect this breach itself and learned of it from “outside agencies after the data had already been published”. On the same day, a threat-monitoring account on X flagged a claim by a group calling itself “Siriusim” that it had released the data on the Dark Web.
The SBI said the incident does not have any material impact on Bank’s Core business operations, financial performance or business continuity. “The Bank’s core business functions continue to operate normally without disruptions,” it stated without mentioning anything relating to the impacted customers.
What does the data breach at SBI mean?
A claim like this is a warning signal, not a verdict. The threat actor Siriusim says it holds 3,75,000 SBI-linked customer records and 2,722 PDF documents, but SBI has not confirmed the claim, and we have not verified the data, said Saurabh Sharma, Security Researcher, Global Research and Analysis Team (GReAT), Kaspersky.
“The risk does not depend on verification, because our research on what happens to stolen data shows it enters a shadow market where it circulates for years, changing hands and being reused in new attacks,” he stated.
For customers, the practical meaning is more convincing fraud, not a one-off event. Stolen data becomes a long-term weapon because attackers combine it with older breach data to craft personalised scams. The concern is what follows the leak in the coming months, Mr. Sharma said.
How serious is this matter?
The incident is serious, though its full scale is not yet clear, said Rajesh Chhabra, General Manager – India & South Asia at Acronis. “SBI has said about 3,897 records with personal information were identified among roughly 3.75 lakh records posted on the dark web. That is a preliminary count, and the investigation will need to confirm what the rest of the data and the leaked documents contain,” he stated.
What are the consequences?
Fraud could be the main consequence. Names, phone numbers, dates of birth, and addresses are enough for targeted phishing, impersonation and loan-related scams, and customers are most at risk in the coming weeks.
“The exposed fields suggest the data may have come from lead-management or connected third-party systems rather than core banking. These are often the weakest points in financial institutions. SBI also reportedly learnt of the exposure through external alerts, which points to a gap in internal detection,” Mr. Chhabra said.
What needs to be done?
The bank should complete the investigation quickly and inform affected customers directly. Customers should be wary of unsolicited calls, links, or messages that refer to their accounts or loans, and should never share OTPs.
“Banks more broadly should tighten vendor access, monitor the dark web for their own data and respond faster, as AI is shrinking the time between a leak and a fraud campaign,” Mr. Chhabra said.
How much customer data has been breached?
According to SBI, during the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing personally identifiable information (PII) were identified.
According to Internet Freedom Foundation “Siriusim” had claimed that it had released 3.75 lakh rows of SBI data and 2,722 PDF documents, including loan applications and account opening forms.
“The bank’s disclosure does not mention these documents. It also does not say what the remaining records, beyond the 3,897 it has identified, contain,” the Foundation said.
So far SBI has not provided any clarity or released any supplementary information.
The Foundation has demanded that SBI state what the 3.75-lakh records and the 2,722 documents contain, how many customers they relate to, and whether they include KYC documents such as Aadhaar, PAN, or passport copies.
As and when the investigation concludes, SBI must disclose how the data left its systems, including whether it came through a vendor or a direct selling agent, and publish a summary of the investigating agency’s findings.
Who is at risk?
Anyone whose details are in the file is at risk, whether or not they bank online. Reports say the data covers names, loan applications, KYC documents and addresses, which is exactly what a fraudster needs to impersonate a customer. India was also among the most affected countries in our April 2026 findings, where credentials for over a million online banking accounts at the world’s 100 largest banks were freely shared on the dark web in 2025, according to Mr. Shama of Kaspersky.
Stolen data also ages slowly: 74% of the compromised payment cards we identified in 2025 were still valid in March 2026. Loan applicants and customers with KYC documents on file should treat any unexpected call or message that quotes their real details as a red flag, he stated.
How big is the breach?
According to Mr. Sharma a seller’s number is not an audited figure. The 3,75,000 rows and 2,722 PDFs are what the poster claims, and forum listings often pair a few genuine samples with an inflated total. “Size is also the wrong yardstick: our infostealer research estimated 2.3 million bank cards leaked on the dark web, and every 14th infostealer infection resulted in stolen card details,” Mr. Sharma said.
The question that matters is what each record lets a criminal do. Even a fraction of 3,75,000 KYC-linked records is enough to run fraud at scale. In 2025 alone, over a million online banking accounts fell victim to infostealers, he added.
How did the breach happen?
“The how is unconfirmed, and anyone claiming certainty today is guessing. It is unclear whether the data came from SBI directly, a subsidiary, a third-party provider or older leaks. The routes we see most in financial services are infostealers, phishing and supply chain compromise. Infostealer detections on PCs rose 59% globally from 2024 to 2025, harvesting logins, cookies, card numbers and autofill data,” Mr. Sharma said.
The Kaspersky Security Bulletin 2025 also describes supply chain attacks in which a third-party provider’s weakness cascaded through national payment networks. Any investigation should test the vendor path as hard as the bank’s own systems, he added.
What are banks doing to prevent such breaches?
The better-prepared banks are moving from perimeter defence to continuous visibility: threat intelligence, round-the-clock monitoring, vendor risk reviews and staff training. They need to, because the Kaspersky Security Bulletin 2025 shows threats now span AI-enabled malware, supply chain compromise and NFC fraud, according to Mr. Sharma.
“Our advice to financial organisations is to assess the whole infrastructure, deploy integrated platforms that monitor every attack vector and train people as a human firewall. The baseline is rising, but it is not yet universal,” he stated.
What did SBI do after it learnt about the breach?
The Bank said it promptly activated its cyber incident response and containment protocols.
Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise.
What measures have been taken by SBI for the impacted customers?
SBI has issued a generic statement on X saying that the data leak has impacted a very small number of customers.”
“We wish to assure that it does not have any material impact on Banks IT and Core business operations, financial performance or business continuity. Customer balances are completely safe and we are taking all possible steps to protect the interests of our valued customers,” it said in the social media post.
“We reiterate that safety of our customers’ financial assets, data and their trust in us remain our highest priorities,” it stated.
It is believed that SBI has not called the impacted customers one on one informing them that their personal data has been compromised. SBI could not confirm or deny this.
According to the Foundation, SBI had not informed any of the affected customers, and its disclosure to stock exchanges was silent on the point.
“Five days passed between the alert and today’s filing. The filing assures investors that the incident has no material impact on the bank’s operations, financial performance or business continuity. However, it does not state anything to the 3,897 people whose phone numbers, dates of birth and home addresses are now with fraudsters,” the Foundation pointed out.
It has asked SBI to inform each affected customer by SMS, email and letter to the registered address, in English, Hindi and the language of the customer’s branch, stating what data was exposed and what steps they should take.
It should open a dedicated helpline and an online facility for customers to check whether their data is affected, the Foundation has demanded.
