Let’s be honest: the moment you read “bank” and “dark web” in the same headline, your stomach drops a little. If you hold an SBI account, the SBI data hack news probably had you wondering whether your details are out there.
What Happened in the SBI Data Leak?
State Bank of India has confirmed that 3,897 customer records containing personal information were found inside a much larger collection of data on the dark web.
The Times of India reported that SBI disclosed this on October 21, 2026. The bank says it got the first alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency, and CERT-In. After a preliminary look at roughly 3.75 lakh records, it found those 3,897 with customer details.
SBI has brought in an independent cybersecurity agency to investigate. It says the incident hasn’t materially affected core banking operations, financial performance or business continuity. But where the data came from, and how far it goes, is still being figured out.
Quick facts
| Particulars | Details |
| Bank | State Bank of India |
| Records examined | About 3.75 lakh |
| Records with personal information | 3,897 |
| Alert received | October 16, 2026 |
| Public disclosure | October 21, 2026 |
| Reportedly found on | Dark web |
| Impact on core operations | No material impact reported |
3.75 Lakh or 3,897? Here’s the Difference
3.75 lakh is the size of the bigger collection SBI reviewed. 3,897 is how many of those records were found to hold customer personal information. SBI hasn’t said every record in the larger pile belongs to an affected customer, so be careful with any headline that claims lakhs of customers were hacked.
Who’s Behind the SBI Data Breach?
Some reports tie the leak to a threat actor using the name Siriusim, which allegedly claimed to hold a large dataset and PDF files linked to SBI. But SBI hasn’t publicly named anyone responsible or explained how the data ended up online. Until the investigation says otherwise, that’s an allegation, not a finding.
What Customer Data Was Exposed?
Early findings suggest the records included:
- Names and gender
- Mobile numbers
- Dates of birth
- Email addresses
- Residential addresses
- Branch details and CIF (Customer Information File) identifiers
- Lead IDs and metadata tied to loan records
Not every record necessarily had all of these. And the disclosure doesn’t say that passwords, ATM PINs, or account balances were compromised. So don’t assume the worst, but don’t relax completely either.
What Is SBI Doing About It?
Once the alerts arrived, SBI says it activated its cyber incident response and containment protocols and hired an independent cybersecurity agency empanelled by CERT-In. That team will check whether the records are real and complete, trace the likely source, and assess the impact. SBI also says corrective and preventive measures are being put in place where needed.
Still unclear: how exactly the data reached the dark web, and whether every affected customer has been told individually.
Is My Money Safe in SBI?
SBI reports no material impact on its core banking operations, and leaked personal details don’t automatically mean money has been stolen.
But here’s the part that matters. Scammers love this kind of data. Imagine a call from someone who knows your name, number, and maybe your loan details, saying they’re from SBI and your account needs urgent verification.
Because they sound like they know you, you let your guard down, and then they ask for your OTP. That’s the real risk with this SBI data leak: your personal details can make a cyber fraud attempt sound convincing.
How to Protect Yourself From SBI Data Leak Scams
- Never share your credentials. Your OTP, ATM PIN, UPI PIN, and net banking password are for you only, even if the caller claims to be from SBI.
- Be wary of calls that know too much. If someone pushes for an urgent KYC update, payment,t or “account verification”, stop. Contact the bank through official channels before responding.
- Don’t tap unknown links. That goes for SMS, email, and WhatsApp. And never install an app or share your screen because a stranger asked you to.
- Check your transactions often. If anything looks unfamiliar, tell SBI straight away.
- Report fraud fast. If you lose money, call 1930 right away and file a complaint on the National Cyber Crime Reporting Portal. For account help, use the verified contacts on the official SBI website.
The Bottom Line
The SBI data breach doesn’t show that customer funds or banking passwords were compromised, and SBI says its core operations are running normally. But names, phone numbers, birth dates, and addresses are exactly what scammers need to sound believable. So stay sceptical, protect your OTPs and PINs, and report anything suspicious quickly. We’ll know more once the investigation wraps up.
FAQs
- How many SBI customer records were exposed?
SBI’s preliminary review found 3,897 records with personal information among about 3.75 lakh records on the dark web.
- When did SBI report the data leak?
It received alerts on October 16, 2026, and disclosed the incident on October 21, 2026.
- What information was leaked?
Names, gender, mobile numbers, dates of birth, email and residential addresses, branch and CIF identifiers, lead IDs and loan-related metadata.
- Was customer money stolen?
Nothing reported says so. SBI says there was no material impact on core operations, financial performance, or business continuity.
- Who is responsible?
Reports mention a threat actor called Siriusim, but the responsible party and source haven’t been confirmed.
