SBI data breach: How the bank discovered the leak and what followed

Account subscription benefits alongside Premium Stories, Editorials, Opinions and more.

Unlock these with Subscription

The View From India Looking at World Affairs from the Indian perspective.

First Day First Show News and reviews from the world of cinema and streaming.

Today's Cache Your download of the top 5 technology stories of the day.

Science For All The weekly newsletter from science writers takes the jargon out of science and puts the fun in!

Data Point Decoding the headlines with facts, figures, and numbers

THEdge At the cutting edge of education and careers

Health Matters Ramya Kannan writes to you on getting to good health, and staying there

Gender Agenda Stories from beyond the binary.

The Hindu On Books Books of the week, reviews, excerpts, new titles and features.

The State Bank of India | Photo Credit: Reuters

The story so far: Public Sector bank State Bank of India (SBI), the country’s biggest commercial bank with 53 crore customers — meaning every third Indian is an account holder — and a FY26 net profit of over ₹80,000 crore, informed stock exchanges on Wednesday (October 21, 2026), about a customer data breach on the Dark Web.

The incident was reported on October 16, 2026, but SBI admitted the breach only after five days.

In a stock exchange filing, SBI said it had experienced an incident involving the loss of certain data.

It stated that on October 16, 2026, it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert about the suspected exposure of its customer data on the dark web.

While it did not yet know where the data came from, SBI said it had engaged a CERT-In–empanelled agency to investigate.

The Internet Freedom Foundation said that SBI did not detect this breach itself and learned of it from “outside agencies after the data had already been published”.

On the same day, a threat-monitoring account on X flagged a claim by a group calling itself “Siriusim” that it had released the data on the Dark Web.

The SBI said the incident does not have any material impact on Bank’s Core business operations, financial performance or business continuity.

“The Bank’s core business functions continue to operate normally without disruptions,” it stated without mentioning anything relating to the impacted customers.

A claim like this is a warning signal, not a verdict.

The threat actor Siriusim says it holds 3,75,000 SBI-linked customer records and 2,722 PDF documents, but SBI has not confirmed the claim, and we have not verified the data, said Saurabh Sharma, Security Researcher, Global Research and Analysis Team (GReAT), Kaspersky.

“The risk does not depend on verification, because our research on what happens to stolen data shows it enters a shadow market where it circulates for years, changing hands and being reused in new attacks,” he stated.

For customers, the practical meaning is more convincing fraud, not a one-off event.

Stolen data becomes a long-term weapon because attackers combine it with older breach data to craft personalised scams.

The concern is what follows the leak in the coming months, Mr.

Sharma said.

The incident is serious, though its full scale is not yet clear, said Rajesh Chhabra, General Manager – India & South Asia at Acronis.

“SBI has said about 3,897 records with personal information were identified among roughly 3.75 lakh records posted on the dark web.

That is a preliminary count, and the investigation will need to confirm what the rest of the data and the leaked documents contain,” he stated.

Fraud could be the main consequence.

Names, phone numbers, dates of birth, and addresses are enough for targeted phishing, impersonation and loan-related scams, and customers are most at risk in the coming weeks.

“The exposed fields suggest the data may have come from lead-management or connected third-party systems rather than core banking.

These are often the weakest points in financial institutions.

SBI also reportedly learnt of the exposure through external alerts, which points to a gap in internal detection,” Mr.

Chhabra said.

The bank should complete the investigation quickly and inform affected customers directly.

Customers should be wary of unsolicited calls, links, or messages that refer to their accounts or loans, and should never share OTPs.

“Banks more broadly should tighten vendor access, monitor the dark web for their own data and respond faster, as AI is shrinking the time between a leak and a fraud campaign,” Mr.