In what appears like a major cybersecurity failure, the personal data of nearly 4000 State Bank of India (SBI) customers was found leaked on the dark web. The state-run bank on Wednesday (October 21, 2026) issued a statement disclosing the exposure of its customer data on the dark web.
The SBI said that on October 16, 2026, it received an alert from the received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding the exposure.
Personal data of customers leaked
Following the alert, the bank conducted a preliminary analysis of around 375,000 records available on the dark web, which revealed that Personally Identifiable Information (PII) relating to 3,897 customer records was available on the dark web. The information included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, and branch and CIF identifiers.
“During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files,” the SBI said.
Remedial and preventive measures being implemented
The bank said that it swiftly activated its cyber incident response and containment protocols in response to the data breach. Besides, it engaged an independent CERT-In-empanelled cybersecurity agency “to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise”.
“A detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank. The Bank promptly activated its cyber incident response and containment protocols. Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise,” the bank said.
The bank, however, assured that the data breach would not have any “material impact” on its Core business operations, financial performance, or business continuity. It added that appropriate remedial and preventive measures are being undertaken. “The Bank’s core business functions continue to operate normally without disruptions. A detailed assessment is currently underway, and appropriate remedial and preventive measures are being implemented as required,” the bank stated.
Hacking group claims responsibility
Following the SBI’s disclosure, an unidentified hacker group named ‘Siriusim’ claimed responsibility for the cyberattack. A cybersecurity monitoring account, Cyber Pulse (@cyberpulse56), posted a message on X saying that the hacker group leaked customer documents and personal data associated with the SBI. However, the veracity of the claim remains unverified.
Although the SBI has assured that the data breach will have no impact on the bank’s operations, this may pose significant threats to the customers whose personal information has been leaked. The leaked data could be used by scammers to make scam calls to the customers, making them more prone to cyber scams.
