On 21 October 2026, State Bank of India (SBI), India’s largest public sector bank, disclosed to the stock exchanges that it had experienced an incident involving the loss of certain data. According to SBI, a preliminary examination of approximately 3.75 lakh records found on the dark web identified 3,897 customer records containing personally identifiable information. The information reportedly includes customers’ names, gender, registered mobile numbers, dates of birth, email addresses, residential addresses, branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records.
SBI has stated that it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). It has activated its incident response protocols and engaged an independent cybersecurity agency empanelled with CERT-In to investigate the incident. SBI has also stated that its core business operations, financial performance and business continuity have not been materially affected.
However, the absence of an immediate impact on the bank’s operations does not establish that customers face no risk. Financial data is particularly valuable to fraudsters because it can be used to make fraudulent communications appear credible. A person who knows a customer’s name, mobile number, date of birth, branch, customer identifier or loan-related details can impersonate a bank official with greater plausibility. Such information can facilitate targeted phishing, fraudulent loan offers, identity theft, social engineering, impersonation and other forms of financial fraud. If additional documents or identity records have also been exposed, the risks could be more serious.
These threats cannot be addressed by repeating generic advice that customers should never disclose their passwords or one-time passwords (OTPs). Customers cannot reasonably be expected to distinguish a legitimate communication from a fraudulent one when an impersonator may possess information that customers reasonably expect only their bank to know.
The burden of preventing, investigating and responding to a data breach must therefore rest primarily on the institutions that collect and retain this information.
- SFLC.in calls on SBI to directly notify all customers whose personal information has been identified as exposed. Although Section 8(6) of the Digital Personal Data Protection Act, 2023, read with Rule 7 of the DPDP Rules, 2025, which establishes a framework for breach notification to the Data Protection Board and affected individuals are scheduled to enter into force only on 13 May 2027, the implementation window should not become a reason for leaving customers uninformed. CERT-In’s 2021 Advisory CIAD-2021-0004 on preventing Data Breaches / Data leaks recommends that organisations promptly notify affected users, explain the information compromised, and provide remedial guidance. The RBI’s March 2026 advisory on cyber incidents should also be applied in determining SBI’s customer-notification responsibilities. We urge SBI to act in accordance with these safeguards immediately by informing affected customers the nature, extent and timing of the breach, the likely consequences for the customer, mitigation measures taken, safety measures the customer can take and business contact details of a person at SBI who can answer queries relating to this.
- We also call on the SBI to complete its investigation, disclose its findings and explain the protection offered to affected customers. SBI has disclosed the preliminary finding of 3,897 records containing personal information among approximately 3.75 lakh records examined. However, the threat actor’s separate claim of possessing 2,722 PDF documents, reportedly including loan applications and account-opening forms, has not been independently verified. SBI should clarify how many unique customers are affected, and whether the material includes KYC documents, loan applications, account-opening forms or other sensitive financial information. The investigation should identify the source and mechanism of the exposure, the systems and third parties involved, the security controls that failed, and the remedial measures adopted. SBI should publish a detailed report of the substantive findings.
Read our statement here:
