SBI Discloses Suspected Data Exposure
State Bank of India (SBI), India's largest state-owned bank, disclosed in a stock-exchange filing dated October 21, 2026 that it identified 3,897 customer records containing personal information within a set of roughly 375,000 records circulating on the dark web. The bank says it does not yet know where the data originated.
Details
| Attribute | Detail |
|---|---|
| Disclosure | Stock-exchange filing, October 21, 2026 |
| First alert | October 16, from the bank's threat-intelligence provider, the Defence Cyber Agency, and CERT-In |
| Dataset size | About 375,000 records (may include duplicates) |
| Confirmed customer records | 3,897 |
| Source of data | Unknown; independent investigation underway |
| Operations | SBI reports no material impact |
Data fields reported: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata tied to loan and lead records. The filing does not list account numbers, balances, passwords, OTPs, card details, or PAN/Aadhaar numbers.
An anonymous group called Siriusim previously claimed to hold data on about 375,000 SBI customers, with reports linking the claim to BreachForums. SBI has not attributed the incident to that group. The 375,000 figure should not be read as the number of confirmed victims.
Risk to Customers
Exposed contact and loan-lead details are well suited to phishing, impersonation calls, and loan scams that reference real branch or product information.
Recommendations
- Treat unsolicited calls, SMS, or email claiming to be from SBI with suspicion; the bank does not ask for OTPs or passwords.
- Verify requests through official channels before sharing any information.
- Monitor accounts for unusual activity and report fraud promptly.
- Organizations in financial services should review third-party lead and CRM data flows, a common source of this type of metadata exposure.