SFLC.in has written to the State Bank of India (SBI), India’s largest public sector bank, raising our concerns over a recent incident involving the loss of data due to malicious attacks. In our letter, we have sought accountability for the leaks themselves and transparency from SBI over the types of data that were breached, remedial steps being taken, and whether all affected consumers have been notified and made whole.
On 21 October 2026, SBI disclosed to the stock exchanges that it had experienced an incident involving the loss of certain data. According to SBI, a preliminary examination of approximately 3.75 lakh records found on the dark web identified 3,897 customer records containing personally identifiable information. The information reportedly includes customers’ names, gender, registered mobile numbers, dates of birth, email addresses, residential addresses, branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records.
SFLC.in published our [statement](https://sflc.in/sflc-in-statement-on-the-sbi-data-breach/) on the Data Breach on October 23 calling on the SBI to notify all affected users on the nature, extent and timing of the breach, the likely consequences for the customer, mitigation measures taken, safety measures the customer can take and business contact details of a person at SBI who can answer queries relating to this. We also requested the SBI to complete its investigation, disclose its findings and explain the protection offered to affected customer
Please find the letter below.
