Story so far:
Five days after receiving communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of its customer data on the dark web, the State Bank of India (SBI), India’s largest commercial bank, on Wednesday (October 21, 2026) informed stock exchanges about the incident involving the loss of certain data.
“During the preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified,” SBI told the exchanges as per SEBI disclosure norms.
Here is what we know about the breach, the potential risks and the steps customers can take to protect themselves:
What’s the motive behind exposing data?
A forum alias is not an attribution; one can’t guess. “The claim comes from an actor using the name Siriusim, and we have no basis to comment on its identity or origin. The motive is almost always money. Our April 2026 research describes the dark web as a central hub for financial cybercrime, where stolen data is aggregated, repackaged and sold,” Saurabh Sharma, Security Researcher, Global Research and Analysis Team (GReAT), Kaspersky said.
Data does not need to be fresh to be valuable. Kaspersky Digital Footprint Intelligence has seen attackers bundle stolen data into verified “dumps” that sell in bulk for as little as $50. The Kaspersky Security Bulletin 2025 also found organised crime blending social engineering, insider manipulation and technical exploitation, so buyers know how to use it, he stated.
What type of data is at risk?
Identity data does more damage than a stolen password. Reports say the alleged dataset includes customer names, loan applications, KYC documents, account-opening forms and addresses. A password can be reset in minutes, but a photograph, ID number and address proof cannot, Mr. Sharma said.
“Our phishing research shows attackers combine names, addresses and dates of birth into “digital dossiers” that make later scams believable. The Kaspersky Security Bulletin 2025 also flags growing underground demand for deepfake services built to bypass KYC verification. Leaked KYC files give that trade real material to work with,” he added.
What should SBI customers do now?
Assume the data is already in circulation and act before a fraudster does. Never share an OTP, PIN or CVV, and do not click links in messages claiming to be from the bank. Change your net banking and YONO passwords, switch on two-factor authentication, enable transaction alerts and ask the bank to block any card you suspect is exposed, as Kaspersky experts advise.
“Check your account for devices or IP addresses you do not recognise and end those sessions immediately. Treat any call about loans, KYC updates or account blocks as fraud until you verify it through the SBI app or a branch, and always check the sender’s address before opening an email,” Mr. Sharma said.
What should the regulator do?
Regulators should treat disclosure speed as a customer safety control. Once a claim looks credible, they should push for rapid forensic verification, plain-language customer notification and adherence to existing CERT-In and RBI reporting timelines.
They should also extend security audits to third-party vendors, because the Kaspersky Security Bulletin 2025 shows one provider’s weakness can reach even central systems. We recommend proactive dark web monitoring so compromised accounts are caught before they harm customers. A shared threat intelligence channel across banks would turn one institution’s incident into every institution’s early warning.
The Reserve Bank of India should direct all regulated entities to notify customers of personal data breaches within a fixed period, pending the commencement of the DPDP Act said the Internet Freedom Foundation.
Besides, the Ministry of Electronics and Information Technology must bring Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules into force immediately the Foundation said.
Has this happened before with SBI or other banks?
Yes, and the sector remains a prime target, according to Mr Sharma. Public reports recall a 2019 exposure of an unprotected server behind SBI’s SMS banking service, which SBI said did not compromise its own servers, and Bank of Baroda acknowledged a data leak in July 2026.
Globally, 12.8% of B2B finance organisations faced ransomware between November 2024 and October 2025, and we detected 1,338,357 banking Trojan attacks in the same period. In India, the sectors we see repeatedly hit by ransomware include IT, BFSI, manufacturing and healthcare.
How to file a complaint?
Speed decides the outcome, because stolen financial data stays usable: 74% of the compromised cards we tracked were still valid months later. First, call the bank to block cards and accounts and report any unauthorised transaction immediately. Under RBI’s customer protection norms, reporting within three working days limits your liability in third-party fraud, Mr Sharma said.
Second, file a complaint on the National Cybercrime Reporting Portal (cybercrime.gov.in) or call 1930. If the bank does not resolve it, escalate to the RBI Integrated Ombudsman. Keep screenshots, messages and transaction details, since investigators will ask for them, he advised.
Globally, what are the top breaches?
The pattern matters more than the ranking. In the financial sector we track, the common thread is stolen credentials and third-party access, not exotic exploits. Infostealer detections rose 59% globally between 2024 and 2025, and over a million online banking accounts at the world’s largest banks had credentials circulating on the dark web.
The Kaspersky Security Bulletin 2025 recorded 1,338,357 banking Trojan attacks between November 2024 and October 2025, with Trojans increasingly rewritten to spread through messaging apps. Protect the credential and the vendor, and you close the most common doors.
How to protect customers from such a breach?
Hold less data, guard what remains and watch the dark web. Banks should encrypt KYC records at rest, restrict access by role, log every retrieval and apply the same controls to vendors. Our research recommends proactive dark web monitoring so compromised accounts are detected before they harm customers or employees, Mr. Sharma said.
Customers should follow Kaspersky’s guidance on what to do when data has been stolen, and back it with multi-factor authentication and transaction alerts. These blunt most follow-up attacks, he added.
What are banks doing to prevent such breaches?
The better-prepared banks are moving from perimeter defence to continuous visibility: threat intelligence, round-the-clock monitoring, vendor risk reviews and staff training. They need to, because the Kaspersky Security Bulletin 2025 shows threats now span AI-enabled malware, supply chain compromise and NFC fraud, according to Mr. Sharma.
“Our advice to financial organisations is to assess the whole infrastructure, deploy integrated platforms that monitor every attack vector and train people as a human firewall. The baseline is rising, but it is not yet universal,” he stated.
What is the likely impact on customers?
These customers are the most likely to receive calls from persons posing as SBI officials who can recite their account details back to them.
The Internet Freedom Foundation called on SBI to inform every affected customer directly and without further delay.
Is SBI liable to inform customers about their breach and associated risk?
The law today does not compel the bank to do so. Section 8(6) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to intimate a personal data breach to the Data Protection Board and to each affected Data Principal, and Rule 7 of the DPDP Rules, 2025 prescribes how this is to be done according to the Foundation.
But the Union Government chose a staggered commencement, and these provisions will take effect only on 13 May 2027, nearly four years after Parliament enacted the law.
The reporting obligations that apply today, under the CERT-In Directions of 28 April 2022 and the RBl’s cyber security framework for banks, are owed to regulators and not to customers,” it said.
“A listed bank is bound to keep the stock exchanges informed. No law in force clearly binds it to inform the people whose data it holds,” the Internet Freedom Foundation said.
