State Bank of India discloses data loss: 3,897 customer records with personal details found in a set of about 375,000 records on the dark web, flagged by CERT-In and the Defence Cyber Agency on 16 October
State Bank of India (SBI), India's largest bank, told the BSE and NSE stock exchanges on 21 October 2026 that it 'has experienced an incident involving the loss of certain data'. On 16 October it received alerts from its threat intelligence provider, India's Defence Cyber Agency and CERT-In about suspected exposure of SBI customer data on the dark web. In a preliminary analysis of about 375,000 records available there, the bank identified 3,897 customer records containing personal information. The filing says the exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs, and metadata from loan and lead records and related files. Account numbers, passwords, card details and government ID numbers are not among the categories listed. SBI says it activated its incident response and containment procedures, engaged an independent CERT-In-empanelled firm to investigate the authenticity, source and extent of the exposure, and that there is no material impact on its core operations. The filing does not say whether SBI's own systems, a subsidiary or a third party were the source, or whether affected customers will be notified. The Hacker News notes the data was advertised on a cybercrime forum and that the details are useful for impersonation calls and messages. Primary: SBI Regulation 30 disclosure to BSE/NSE (21 Oct 2026); wire: The Hacker News (21 Oct).
- Exploited in Australia?
- unknown
- Patch to
- SBI customers should expect impersonation attempts using their name, mobile number, date of birth, branch and customer ID; verify any call or message claiming to be from the bank through official channels and never share OTPs or passwords. SBI asks customers to report incidents to report.phishing@sbi.co.in or India's cybercrime helpline 1930.
Primary: State Bank of India — Regulation 30 disclosure: Incident involving Data Loss (NSE/BSE filing, 21 Oct 2026) · Vendor: State Bank of India — stock exchange filing (company statement) · The Hacker News — State Bank of India confirms data leak after 3,897 customer records found on dark web (21 Oct 2026)