SBI’s October 21, 2026 filing says 3,897 customer records with personal details were found in a first review of data on the dark web. The bank is still checking where the data came from and how much may be involved.
The dark web is a part of the internet that needs special tools to visit. A record is one entry in a list. It may hold details about a person, such as their name or phone number.
What happened?
On October 16, State Bank of India (SBI) received warnings from its threat intelligence provider, India’s Defence Cyber Agency, and CERT-In, the country’s computer emergency response team. The warnings concerned possible exposure of customer data on the dark web.
SBI then looked at about 375,000 records available there. In that first review, it identified 3,897 records containing information that could identify SBI customers. The bank reported this to the stock exchanges on October 21.
The two numbers mean different things. 375,000 is the size of the group of records SBI reviewed. It is not a confirmed count of SBI customers affected. The bank identified 3,897 customer records in that group, and its investigation is continuing.
What information was found?
SBI said the information reportedly included names, registered mobile numbers, dates of birth, gender, email and home addresses. It also listed some bank and customer identifiers, plus details linked to loan enquiries. These are forms of personal information: details that can help identify a person.
Do we know how the data got there?
No. The filing does not establish the source of the data or how it reached the dark web. SBI says an independent cybersecurity agency is helping it check whether the data is genuine and complete, where it came from, and how far the exposure extends. The filing does not establish that someone entered SBI’s core banking systems. It also does not claim that AI was used.
SBI says it started its incident response process and that its main banking services continue to work normally. That statement is about service operations; it does not finish the investigation into the data.
What could someone do with these details?
A scammer could use a real name, phone number, or loan detail to make a fake bank message sound convincing. This is a possible risk based on the kinds of information listed, not a fraud case confirmed by SBI’s filing. A message might ask you to click a link or share a one-time password (OTP), the short code sent to approve an action.
What should customers do?
- If you get an urgent bank message, open SBI’s official app or website yourself. Do not use a link in the message.
- Never tell anyone your OTP, PIN, password, or card security code. SBI’s cyber safety advice says the bank will not ask for these details.
- Watch your account alerts and statements. If something looks wrong, contact SBI through a number or channel on its official website. SBI also lists 1930 as India’s cybercrime helpline.
For businesses that hold customer data, the useful lesson is to check reported data against your own records, keep evidence that may show where it came from, and tell customers what is known and what is still being checked.
If your organization is reviewing its data protection and response process, AZAS Technologies describes its cybersecurity services here.
Sources
- SBI disclosure to BSE and NSE, October 21, 2026. Primary source for the October 16 alert, preliminary record counts, reported data types, investigation, and business operations.
- SBI cyber security guidance, accessed October 21, 2026. Primary source for customer safety and reporting advice.
AZAS Technologies did not investigate this incident.
