21/10/2026
Share:
21/10/2026
Share:
MUMBAI, Oct 21: State Bank of India (SBI), India’s largest public-sector lender, has launched an investigation into a suspected data leak after approximately 375,000 records surfaced on the dark web, with preliminary analysis identifying 3,897 customer records containing personally identifiable information.
The bank disclosed the incident in a stock-exchange filing on Wednesday, saying it had received alerts on October 16 from its threat-intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) regarding the suspected exposure of customer data.
SBI said it immediately activated its cyber-incident response and containment protocols and appointed an independent cybersecurity agency empanelled by CERT-In to investigate the nature and extent of the suspected compromise.
The investigation is intended to establish the authenticity and completeness of the exposed data, determine its possible source and assess the risks to customers and the bank.
“A detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank,” SBI said in its disclosure.
Personal and loan-related information potentially exposed
According to the bank’s preliminary assessment, the information identified in the exposed records included customers’ registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses.
The records also reportedly contained branch details, Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan applications, customer leads and related files.
The exposure of such information raises concerns about potential identity misuse, impersonation and targeted fraud, particularly if criminals use genuine customer details to pose as bank officials or contact borrowers with fraudulent offers.
However, the bank has not yet established the complete scope of the incident or confirmed the authenticity of all the records found online.
It also remains unclear what information is contained in the remaining records among the approximately 375,000 reviewed. The preliminary figure of 3,897 refers to customer records identified as containing personally identifiable information, not necessarily the total number of individuals affected.
SBI says banking operations unaffected
SBI said the incident had not had any material impact on its core business operations, financial performance or business continuity.
The bank added that its operations continued normally while the investigation and assessment were underway.
The independent cybersecurity agency has been tasked with examining the suspected compromise and helping establish the source and extent of the exposure. SBI said appropriate remedial and preventive measures were being implemented as required.
The bank has not publicly established how the data was exposed or identified a responsible individual or group in the information available so far.
Incident comes amid warnings over AI-driven cyber threats
The disclosure comes amid growing concern over cyberattacks targeting India’s financial and technology sectors.
CERT-In recently warned that artificial intelligence tools were being used in cyber operations and that AI agents had, in some reported incidents, accessed live systems and confidential information beyond their authorised tasks. The agency also highlighted how AI-assisted techniques could accelerate reconnaissance and exploitation of security weaknesses. Separately, Indian cybersecurity authorities have warned financial institutions about attacks targeting non-banking financial companies, digital lenders, fintech firms and payment service providers.
These developments have intensified concerns about the ability of cybercriminals to exploit weaknesses in digital infrastructure and gain access to sensitive customer information.
However, there is no confirmed evidence linking the SBI data exposure to an AI-driven attack. The bank’s investigation is still under way, and the method through which the records became available on the dark web has not been established.
The incident underscores the importance of protecting customer information, monitoring third-party access and strengthening cybersecurity safeguards as banking services increasingly rely on digital platforms.
