State Bank of India reports preliminary customer data exposure
State Bank of India says it is investigating a preliminary data-loss incident after 3,897 customer records were found among a larger set of data offered online.
State Bank of India has reported a preliminary customer-data exposure after an investigation found 3,897 records containing personally identifiable information among roughly 375,000 records available on the dark web. The bank says the figure is preliminary: it has not yet established whether all the data is authentic, where it came from or how many people may be affected.12
What the bank has confirmed
The bank disclosed the incident in a filing to India's stock exchanges dated 21 October. It said it received alerts on 16 October from its threat-intelligence provider, India's Computer Emergency Response Team (CERT-In) and the Defence Cyber Agency about a suspected exposure of customer data.1
The categories reportedly found include registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan or lead records. The filing does not say that account numbers, balances, passwords, one-time passcodes, card details or government identity numbers were exposed.1
That distinction matters, but it does not make the incident harmless. A combination of a name, phone number, date of birth, address, branch and internal customer identifier could give scammers enough context to make impersonation attempts sound convincing. The bank has not said whether the 3,897 records represent 3,897 separate customers.
Investigation remains open
State Bank of India says it activated its cyber-incident response and containment procedures and hired an independent cybersecurity agency from CERT-In's approved panel to investigate the alleged compromise. The filing says the bank's core operations, financial performance and business continuity have not been materially affected.1
The disclosure does not identify an attacker, name a confirmed breach of an SBI system or establish that the wider dark-web dataset came directly from the bank. The Hacker News reported the filing alongside details of a wider claimed dataset, but the bank's own statement leaves the source and completeness of the exposure unresolved.2
Customers should treat unexpected calls, messages or emails that quote personal details as suspicious. The bank's cyber-security guidance directs customers to report cyber incidents to report.phishing@sbi.co.in or India's national cybercrime helpline on 1930.2
Our opinion
The most important part of this story is what SBI has not claimed. This is a serious preliminary exposure involving personal information, but it is not yet proof that an SBI database was breached or that every record in the larger dataset is genuine. Keeping that uncertainty visible is essential: overstating the incident could create panic, while understating the value of the leaked fields would ignore the real impersonation risk.
SBI's next updates should clarify whether the records are authentic, whether the source was an SBI system or a third-party provider, how many customers are affected and what notifications or protective measures will follow. Until then, customers should assume that convincing-looking scam attempts may use information that feels specific, and verify contact through official bank channels rather than replying to an unexpected message.