SBI confirms 3,897 customer records found on dark web, starts probe

State Bank of India (SBI) has confirmed that 3,897 records of its customers containing personal details were found in data circulating on the dark web, in a disclosure to the stock exchanges reported on October 21, 2026. The bank said a preliminary review of about 3.75 lakh records turned up these 3,897 with personally identifiable information, and that it has hired an independent cyber-security agency empanelled by CERT-In, the national cyber-security agency, to find the source. Last week the size and authenticity of a hacker's claim about SBI data were unverified; the bank's own disclosure now confirms that real customer data is out there, though on a far smaller scale than the claim suggested.

For young people who opened their first bank account with SBI, or took an education loan through it, this is not abstract. The kind of data SBI describes, a name, a phone number, a date of birth, an address and the fact that someone enquired about or took a loan, is exactly what fraudsters use to make a call or message sound genuine. A caller who knows your name, your branch and that you applied for a loan is far more convincing than a random scammer.

The first reports last week rested on a hacker's post on a criminal forum, and no one could say whether the data was real. SBI's disclosure changes that. It confirms that thousands of real customer records are exposed, while also suggesting that most of the 3.75 lakh records did not contain personal information. It does not yet say how the data leaked, whether from the bank's own systems, a partner or a third-party service.

The case also raises the question of how customers learn about such leaks. Digital-rights group the Internet Freedom Foundation has pointed out that the bank has informed stock exchanges but has not said whether it has told the affected customers. The group says India's Digital Personal Data Protection Act, 2023 provides for informing people of a breach, but that the law as in force today does not yet compel the bank to do so.

Short-term: Customers whose details are in the leak may get more phishing calls, SMS and emails that mention real personal details. Standard safety practice applies: never share an OTP, PIN, password or card number with a caller, do not click links in unexpected messages, and report suspected fraud on the national cyber-crime helpline 1930 or the cybercrime.gov.in portal.

Long-term: The investigation's finding on where the data came from will matter for how banks handle data shared with partners and loan agents. The case may also add pressure for clearer rules on telling customers directly when their data leaks.

Who is affected: The 3,897 SBI customers whose records were identified, other SBI account holders who may receive scam attempts, and first-time and student borrowers whose loan enquiries appear in such data.

Questions and Answers