State Bank of India Says 3,897 Customer Records Surfaced on Dark Web; Source Not Stated
State Bank of India told the stock exchanges on 21 October 2026 that 3,897 customer records were among about 375,000 found on the dark web. The filing leaves key questions open.
The State Bank of India told the stock exchanges on 21 October 2026 that it had found 3,897 customer records containing personal information among about 375,000 records on the dark web. The bank said alerts reached it on 16 October from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, known as CERT-In.
The filing does not say how the records left the bank, how many customers they concern, or whether those customers have been told. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, notice to affected people is a defined duty with time limits, and those provisions take effect only in May 2027.
What SBI's Exchange Filing Says
The disclosure was made in a filing to the stock exchanges dated Wednesday, 21 October 2026. The Internet Freedom Foundation (IFF) describes it as a disclosure under Regulation 30 of the SEBI listing rules. The Hacker News reports that SBI said it had experienced an incident involving the loss of certain data.
The 3,897 figure is preliminary. It comes from a review of about 3.75 lakh records, roughly one in every hundred examined, according to The Hacker News. The bank has not said whether the 3,897 records belong to 3,897 separate people.
The filing says the exposed information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata tied to loan and lead records. The Hacker News reports that account numbers, balances, passwords, one-time passcodes, card details, PAN and Aadhaar numbers are not among the listed fields.
SBI says the incident has no material impact on its core business operations, financial performance or business continuity. The Hacker News notes that this statement concerns the bank, not the customers whose details are in the dataset.
Alerts From CERT-In and the Defence Cyber Agency, and the Claimed Attacker
UNI India reports that the alerts reached SBI on 16 October from its threat intelligence service provider, the Defence Cyber Agency and CERT-In. IFF says the data had already appeared on the dark web by that date.
SBI then activated its incident response procedures and engaged a security firm from CERT-In's panel of approved auditors, according to The Hacker News.
Before the filing, a monitoring account called CyberPulse56 flagged a claim on X on 16 October. The Hacker News reports that an actor using the name Siriusim claimed to have leaked about 375,000 CSV rows and 2,722 PDF documents, said to include personal information, loan applications, supporting documents and account-opening forms.
The Free Press Journal checked four sample records posted with the listing on BreachForums. The phone numbers were valid, and one WhatsApp profile photo matched a photo on a KYC document, The Hacker News reports. The same report says that four-record check does not confirm the full set, where it came from, or whether it belongs to SBI, a subsidiary or a third-party provider.
The filing does not name the attacker, and it does not say whether the 2,722 PDFs have been examined.
What the Filing Leaves Open: Source and Customer Notice
The filing says the source of the data is still being investigated. The Hacker News reports that it does not say whether any SBI system was breached, and gives no date for when the records first appeared online.
The filing does not say whether affected customers have been or will be told. IFF has written to SBI, with copies to the Reserve Bank of India and CERT-In, asking the bank to inform each affected customer directly by SMS, email and letter, in English, Hindi and the language of the customer's home branch.
IFF also asks SBI to open a helpline and an online check, to say how many customers the records concern, and to state whether they include Aadhaar, PAN or passport copies. It asks whether a vendor or direct selling agent was involved, and it asks SBI to confirm that customers who lose money will be compensated under RBI customer liability rules.
IFF cites RBI Advisory No. 3/2026, issued on 25 March 2026, which recommends notifying affected customers. It also cites CERT-In Directions of 28 April 2022, which require incident reporting within six hours. IFF asks CERT-In to say what action it has taken and to issue a public advisory on the fraud that may follow.
The bank's statement on materiality concerns SBI, not the customers whose details appear in the dataset.
What the DPDP Act and Rules Require When Personal Data Is Breached
IFF reads Section 8(6) of the DPDP Act, 2023 as requiring a Data Fiduciary to inform the Data Protection Board and each affected Data Principal of a personal data breach. IFF says Section 8(6) is due to come into force in May 2027.
Rule 7 of the DPDP Rules, as set out on dpdpa.com, requires notice to the Board without delay. A fuller follow-up report is due within 72 hours, or within a longer period the Board allows on written request. The initial notice to the Board covers the nature, extent, timing, location and likely impact of the breach. The follow-up within 72 hours covers updated details, broad facts, measures taken or proposed, findings about the person who caused the breach, remedial measures, and a report on the intimations given to affected Data Principals.
For affected individuals, the same rule text requires notice without delay, through the user account or a registered contact, in plain language. The notice must describe the breach and its likely consequences, the steps taken, protective measures the person can take, and a business contact.
The sources differ on timing. S.S. Rana & Co. says the Rules set a 72-hour limit for reporting a breach, but does not say whether that limit applies to the Board, to affected people or to both, and it gives no separate deadline for individuals. Wikipedia describes notice within specified timelines without giving them.
On commencement, S.S. Rana & Co. lists Rule 3 and Rules 5 to 16 for 13 May 2027, 18 months after notification. Rule 7 falls within that range. The same summary dates notification to 13 November 2025 under G.S.R. 846(E), while Wikipedia gives 14 November 2025.
