SBI UNCOVERS 3,897 CUSTOMER RECORDS IN SUSPECTED DARK WEB EXPOSURE; CYBERSECURITY PROBE UNDERWAY
October 21, 2026
NEW DELHI, OCTOBER 21: The State Bank of India (SBI) has identified 3,897 customer records containing personally identifiable information in data suspected to have been exposed on the dark web, prompting a detailed investigation into the authenticity, origin and possible extent of the incident.
The country’s largest public-sector lender said it received alerts about the suspected exposure on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). A preliminary examination of approximately 3,75,000 records found on the dark web identified 3,897 records containing personal information.
According to the bank, the information reportedly included customers’ names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. The records also contained branch details, Customer Information File (CIF) identifiers, lead IDs, metadata connected with loan and lead records, and other related files.
The suspected exposure came to attention after an unidentified hacker group operating under the name ‘Siriusim’ claimed to possess confidential information allegedly linked to SBI. The group reportedly claimed access to approximately 3.8 lakh data entries in CSV format and 2,722 PDF documents, which were said to include personal information, loan applications, account-opening documents and supporting records.
Cybersecurity monitoring account CyberPulse56 highlighted the group’s claim on social media platform X. However, the authenticity and origin of the alleged dataset remain unverified, and the full extent of any potential compromise has yet to be established.
SBI has activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to assess the situation. The ongoing investigation is expected to examine whether the identified records are authentic, how the information may have been exposed, where it originated and what risks the incident could pose to customers and the bank.
The lender has also said that appropriate remedial and preventive measures are being implemented as required. It will continue monitoring the situation and take steps in accordance with applicable regulatory requirements.
Despite the seriousness of the suspected data exposure, SBI has clarified that the incident has had no material impact on its core business operations, financial performance or business continuity. Its regular banking functions continue to operate normally, according to the bank.
The case highlights the risks associated with the exposure of personal and financial information in an increasingly digital banking environment. If misused, details such as residential addresses, contact numbers and loan-related records could potentially facilitate targeted fraud or impersonation. The actual risks in this case, however, will depend on the findings of the ongoing investigation.
For now, the central questions remain whether the data circulating on the dark web is genuine, how it may have been obtained and whether the exposure has affected customers beyond the records identified in SBI’s preliminary assessment. Until the investigation establishes those facts, the alleged breach remains under examination rather than a fully verified account of the incident.
