SBI data breach: What information was exposed and what customers should do
The Reserve Bank of India should direct all regulated entities to notify customers of personal data breaches within a fixed period, pending the commencement of the DPDP Act said the Internet Freedom Foundation.
Account subscription benefits alongside Premium Stories, Editorials, Opinions and more.
Unlock these with Subscription
The View From India Looking at World Affairs from the Indian perspective.
First Day First Show News and reviews from the world of cinema and streaming.
Today's Cache Your download of the top 5 technology stories of the day.
Science For All The weekly newsletter from science writers takes the jargon out of science and puts the fun in!
Data Point Decoding the headlines with facts, figures, and numbers
THEdge At the cutting edge of education and careers
Health Matters Ramya Kannan writes to you on getting to good health, and staying there
Gender Agenda Stories from beyond the binary.
The Hindu On Books Books of the week, reviews, excerpts, new titles and features.
The State Bank of India (SBI).
File | Photo Credit: Reuters
Five days after receiving communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of its customer data on the dark web, the State Bank of India (SBI), India’s largest commercial bank, on Wednesday (October 21, 2026) informed stock exchanges about the incident involving the loss of certain data.
“During the preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified,” SBI told the exchanges as per SEBI disclosure norms.
Here is what we know about the breach, the potential risks and the steps customers can take to protect themselves:
A forum alias is not an attribution; one can’t guess.
“The claim comes from an actor using the name Siriusim, and we have no basis to comment on its identity or origin.
The motive is almost always money.
Our April 2026 research describes the dark web as a central hub for financial cybercrime, where stolen data is aggregated, repackaged and sold,” Saurabh Sharma, Security Researcher, Global Research and Analysis Team (GReAT), Kaspersky said.
Data does not need to be fresh to be valuable.
Kaspersky Digital Footprint Intelligence has seen attackers bundle stolen data into verified “dumps” that sell in bulk for as little as $50.
The Kaspersky Security Bulletin 2025 also found organised crime blending social engineering, insider manipulation and technical exploitation, so buyers know how to use it, he stated.
Identity data does more damage than a stolen password.
Reports say the alleged dataset includes customer names, loan applications, KYC documents, account-opening forms and addresses.
A password can be reset in minutes, but a photograph, ID number and address proof cannot, Mr.
Sharma said.
“Our phishing research shows attackers combine names, addresses and dates of birth into “digital dossiers” that make later scams believable.
The Kaspersky Security Bulletin 2025 also flags growing underground demand for deepfake services built to bypass KYC verification.
Leaked KYC files give that trade real material to work with,” he added.
Assume the data is already in circulation and act before a fraudster does.
Never share an OTP, PIN or CVV, and do not click links in messages claiming to be from the bank.
Change your net banking and YONO passwords, switch on two-factor authentication, enable transaction alerts and ask the bank to block any card you suspect is exposed, as Kaspersky experts advise.
“Check your account for devices or IP addresses you do not recognise and end those sessions immediately.
Treat any call about loans, KYC updates or account blocks as fraud until you verify it through the SBI app or a branch, and always check the sender’s address before opening an email,” Mr.
Sharma said.
Regulators should treat disclosure speed as a customer safety control.
Once a claim looks credible, they should push for rapid forensic verification, plain-language customer notification and adherence to existing CERT-In and RBI reporting timelines.
They should also extend security audits to third-party vendors, because the Kaspersky Security Bulletin 2025 shows one provider’s weakness can reach even central systems.
We recommend proactive dark web monitoring so compromised accounts are caught before they harm customers.
Full detailed coverage is shown on the council website above. Source attribution: The Hindu – Business.
Back to all council news
