Five days after it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of its customer data on the dark web, State Bank of India (SBI), India’s largest commercial bank, on Wednesday, October 21, 2026, informed stock exchanges about the incident involving the loss of certain data.

“During the preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified,” SBI told the exchanges as per SEBI disclose norms. 

The exposed information included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files, it stated. 

It said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.

The bank said it promptly activated its cyber incident response and containment protocols.

Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise, it said.

Emphasising that this incident does not have any material impact on bank’s Core business operations, financial performance or business continuity, the bank said it’s core business functions continue to operate normally without disruptions. 

“A detailed assessment is currently under way and appropriate remedial and preventive measures are being implemented as required,” the bank said.

“We reassure that the bank continues to monitor the situation closely and take all appropriate measures in accordance with applicable regulatory requirements,” it added.

Meanwhile, the Internet Freedom Foundation, in a statement issued on Wednesday (October 21, 2026), stated that SBI did not detect this breach itself and learned of it from outside agencies after the data had already been published.

“On the same day, a threat monitoring account on X flagged a claim by a group calling itself “Siriusim” that it had released 3.75 lakh rows of SBI data and 2,722 PDF documents, including loan applications and account opening forms,” the Foundation said.

“The bank’s disclosure does not mention these documents. It also does not say what the remaining records, beyond the 3,897 it has identified, contain,” it stated.

At the time of this statement, the Foundation pointed out that SBI had not said that it had informed any of the affected customers, and its disclosure was silent on the point. 

“Five days passed between the alert and today’s filing. The filing assures investors that the incident has no material impact on the bank’s operations, financial performance or business continuity. However, it does not state anything to the 3,897 people whose phone numbers, dates of birth and home addresses are now with fraudsters,” the Foundation highlighted. 

“These customers are the most likely to receive calls from persons posing as SBI officials who can recite their account details back to them,” it flagged.

The Internet Freedom Foundation called on SBI to inform every affected customer directly and without further delay.

“We regret to note that the law in force today does not compel the bank to do so. Section 8(6) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to intimate a personal data breach to the Data Protection Board and to each affected Data Principal, and Rule 7 of the DPDP Rules, 2025 prescribes how this is to be done,” the Foudation said. 

“But the Union Government chose a staggered commencement, and these provisions will take effect only on 13 May 2027, nearly four years after Parliament enacted the law. The reporting obligations that apply today, under the CERT-In Directions of 28 April 2022 and the RBl’s cyber security framework for banks, are owed to regulators and not to customers,” it said.

“A listed bank is bound to keep the stock exchanges informed. No law in force clearly binds it to inform the people whose data it holds,” it stated. 

The Internet Freedom Foundation has demanded that SBI must inform each affected customer by SMS, email and letter to the registered address, in English, Hindi and the language of the customer’s branch, stating what data was exposed and what steps they should take. It should open a dedicated helpline and an online facility for customers to check whether their data is affected.

It must state what the 3.75 lakh records and the 2,722 documents contain, how many customers they relate to, and whether they include KYC documents such as Aadhaar, PAN or passport copies.

As and when the investigation concludes, SBI must disclose how the data left its systems, including whether it came through a vendor or a direct selling agent, and publish a summary of the investigating agency’s findings.

The Foundation has asked the Reserve Bank of India (RBI) to direct all regulated entities to notify customers of personal data breaches within a fixed period, pending the commencement of the DPDP Act.

And the Ministry of Electronics and Information Technology must bring Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules into force immediately.

Published – October 21, 2026 12:36 pm IST