After SBI data leak, IBA plans real-time cyber incident sharing among banks

The Indian Banks' Association (IBA) is working on a structured system for banks to share information about cyber attacks with each other, regulators and security agencies in real time, its chairman Challa Sreenivasulu Setty said on Tuesday, 3 November 2026. Setty, who is also chairman of the State Bank of India (SBI), spoke at SBI's results media interaction as the bank continues to investigate a leak of 3,897 customer records that were found online in October. SBI says the incident has had no material impact on its operations and its root-cause analysis is still under way.

Banks are attacked constantly, but they often deal with each incident on their own. A shared, real-time system would mean that when one bank spots a new attack method, others can be warned within minutes rather than days. The UAE's banks, for example, already run such a threat-sharing centre. For India, where digital payments and online banking have grown fast, the idea is to stop the same trick from working at bank after bank.

The SBI case shows why the issue is pressing. The bank learned of the exposure from outside alerts, including from CERT-In and the Defence Cyber Agency, rather than from its own systems first. Recent weeks have also seen other incidents in India's financial and digital sector, including an attack on a securities regulator portal and a security flaw at a digital certificate company, which has added to pressure on institutions to coordinate.

For customers, a leak of names, phone numbers and loan details can be used for targeted fraud, such as calls that sound convincing because the caller already knows personal information. SBI has not said that any accounts were accessed or money lost.

Peepals calculation: The 3,897 SBI customer records were about 1% of the roughly 3.75 lakh records reviewed (3,897 ÷ 3,75,000 = 1.04%). SBI disclosed the incident to the exchanges five days after the first alerts (16 to 21 October), and the IBA plan was described 18 days after those alerts (16 October to 3 November). Our calculation from the reported figures.

Short-term: SBI completes its root-cause analysis, and the 3,897 customers whose details may have been exposed face a higher risk of targeted scam calls and messages.

Long-term: If the IBA mechanism is set up, Indian banks could detect and block attacks faster by learning from each other's incidents, bringing banking closer to a sector-wide early-warning system.

Who is affected: SBI customers, especially those whose records were found; other banks and their customers; CERT-In and financial regulators; and cyber security companies that supply threat intelligence to banks.

Questions and Answers