State Bank of India Confirms Data Breach After 3,897 Records Surface Online
The Indian lender disclosed the incident in an October 2026 filing after threat intelligence partners flagged customer data on dark web forums.
Key points
- State Bank of India confirmed a data loss incident affecting 3,897 customers after reviewing a larger dataset on the dark web.
- Exposed records contain names, addresses, and branch identifiers, but exclude passwords, PINs, or financial balances.
- The bank stated core operations continue normally, though investigators are still verifying the source and authenticity of the leaked information.
State Bank of India confirmed a data loss incident on October 21, 2026, after identifying 3,897 customer records containing personal information in a preliminary review. The bank disclosed the breach in a stock exchange filing, noting that it received initial alerts from threat intelligence partners five days earlier.
Investigators reviewed approximately 375,000 records from the suspected leak and identified the specific customer entries. According to Cyber Security News, the bank is still working to establish the authenticity, completeness, and original source of the data. The filing does not confirm how the information was obtained or whether attackers breached core banking systems.
Context and Background
The exposure was flagged on October 16 by the Defense Cyber Agency and the Indian Computer Emergency Response Team, known as CERT-In. These organizations alerted SBI through its threat intelligence service provider regarding the suspected customer information exposure. The bank immediately activated incident response and containment procedures to manage the situation.
SBI hired an independent cybersecurity agency approved by CERT-In to evaluate the incident. This firm is tasked with investigating the extent of the suspected breach. The bank has not attributed the incident to a specific threat actor or named group in its official disclosures.
Previous reports from The Hacker News linked the dataset size to claims made by a user on the social platform X. That user, operating under the handle CyberPulse56, flagged the potential leak on October 16. Separately, Cyber Security News had covered earlier allegations involving an actor named Siriusim, but SBI’s current filing does not attribute the confirmed records to that specific claim.
Who Is Affected
The confirmed records include names, dates of birth, gender, registered mobile numbers, email addresses, and residential addresses. The data also contains branch details, customer information file identifiers, lead IDs, and metadata linked to loan records. These identifiers allow callers to reference specific internal account details, which could facilitate impersonation scams.
The filing explicitly excludes sensitive credentials and financial data. Passwords, personal identification numbers, one-time passwords, account balances, card details, and government identity numbers such as PAN or Aadhaar were not listed as exposed. SBI reported no stolen funds associated with this incident so far.
The bank stated that the incident has no material impact on core business operations or financial performance. Services continued to operate normally during the investigation. The 3,897 records are roughly 1 in 100 of the records the bank examined, though the bank has not confirmed if these are distinct individuals.
What should you do?
The bank has not yet confirmed if the data is authentic or how it was compromised. Customers should remain vigilant for unsolicited communications that reference personal details found in the leak. SBI is continuing its investigation with the help of external security auditors to determine the full scope of the exposure.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: State Bank of India
- Monitor bank statements and transaction alerts for any unauthorized activity, even if passwords were not exposed.
- Be skeptical of unsolicited calls or messages that cite your name, address, or branch details, as this information was leaked.
- Verify the identity of anyone claiming to be from the bank by hanging up and calling the official customer service number.
- Ensure your contact details with the bank are up to date so you receive official alerts directly.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the State Bank of India breach confirm that hackers accessed core banking systems?
No, the bank stated it does not yet know how the information was obtained and has not established if core systems were breached.
Are passwords or credit card numbers included in the leaked SBI data?
No, the filing lists names, addresses, and identifiers, but explicitly excludes passwords, PINs, card details, and balances.
How many customer records were confirmed to be part of the SBI leak?
SBI confirmed 3,897 customer records containing personal information after reviewing a larger set of approximately 375,000 records.
