In a significant national data security development on October 22, 2026, the State Bank of India (SBI) officially confirmed a cybersecurity incident that led to the unauthorized exposure of customer records on dark web forums. According to official disclosures released by the country’s largest public sector lender, preliminary technical investigations revealed that approximately 3.75 lakh records were accessed, with 3,897 files containing personally identifiable information such as customer names, phone numbers, email addresses, and specific loan details. The security breach was initially detected and flagged by threat intelligence networks alongside the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In), prompting immediate containment measures by SBI’s internal IT security teams. Bank officials reassured account holders that core banking infrastructure, primary transactional servers, and financial deposit systems remain completely secure and unaffected by the breach. Cybersecurity analysts and banking regulatory experts noted that the incident underscores the urgent necessity for financial institutions to continuously reinforce zero-trust architecture, mandate strict encryption protocols, and audit external third-party API integration endpoints to protect sensitive consumer data against sophisticated cyber threats.

Regulatory Disclosure Confirms External Data Exposure

India’s largest public sector banking institution, the State Bank of India (SBI), filed a formal regulatory disclosure with the stock exchanges acknowledging a cyber incident that resulted in the exposure of customer personal records on dark web forums.

The lender initiated immediate cyber incident response protocols after receiving alerts on October 16, 2026, from its Threat Intelligence Service Provider, the Defence Cyber Agency (DCA), and the Indian Computer Emergency Response Team (CERT-In). A preliminary analysis conducted on a larger dataset of 3.75 lakh rows circulating online verified that 3,897 distinct customer records contained sensitive personally identifiable information (PII).

Overview: Key Parameters of the SBI Cyber Incident Disclosure

Incident ParameterOfficial Details & Regulatory Specifications
Reporting InstitutionState Bank of India (SBI)
Alerting BodiesCERT-In, Defence Cyber Agency, & Threat Intelligence Provider
Verified Affected Records3,897 Customer Records (From ~3.75 Lakh Scrutinized Rows)
Exposed InformationNames, Mobile Numbers, DOB, Addresses, CIF IDs, & Loan Metadata
Operational & Financial StatusCore Systems Unaffected; Customer Balances Safe
Investigative ActionEngaged Independent Cybersecurity Agency for digital forensics

Nature of Leaked Customer Identifiers and Forensic Probe

The dataset brought to light by threat intelligence monitors was allegedly posted on an underground forum by an anonymous actor operating under the moniker Siriusim. The leaked materials included CSV files and thousands of PDF documents containing personal lead data, Customer Information File (CIF) identifiers, loan application details, mobile numbers, and residential addresses.

SBI Cyber Incident Response Pipeline: ------------------------------------- Threat Intelligence Alert (Oct 16) ──> CERT-In & DCA Notification ──> Preliminary Data Audit (3,897 PII Verified) ──> Regulatory Stock Filing ──> Independent Forensic Investigation

Despite the breach of peripheral lead and application data, SBI emphasized that the integrity of its core banking system (CBS) remains uncompromised.

"Customer balances are completely safe. The Bank's core business functions continue to operate normally without disruptions. An independent cybersecurity agency has been appointed to establish the authenticity, completeness, and exact source of the exposed data." — State Bank of India Official Statement

Advisory to Banking Customers and Regulatory Alignment

In the wake of the exposure, cybersecurity experts and consumer advocates warned affected individuals to stay vigilant against potential phishing campaigns, fraudulent calls regarding loan approvals, and unauthorized KYC verification requests.

SBI assured stakeholders that it is actively monitoring digital channels and taking all necessary remedial measures in accordance with regulatory mandates from the Reserve Bank of India (RBI) and IT data protection frameworks to safeguard customer interests.