SBI’S FINANCIAL FORTRESS FACES A DATA SECURITY TEST: BANK ASSURES CUSTOMERS THEIR MONEY IS SAFE AFTER DARK-WEB EXPOSURE
October 23, 2026
The State Bank of India (SBI), the country's largest public sector lender, has assured customers that their account balances remain completely safe following a suspected data breach in which thousands of customer records containing personal information were identified on the dark web. The bank said the incident had affected a very small number of customers and had not materially disrupted its information technology systems, core banking operations, financial performance or business continuity.
In its latest communication to customers, SBI sought to reassure account holders that their financial assets remained secure despite concerns over the exposure of sensitive information. The bank reiterated that protecting customers' money, personal data and trust remained among its highest priorities, while confirming that it was taking measures to contain the incident and investigate its implications.
The development follows the bank's disclosure that a preliminary examination of approximately 3.75 lakh records found on the dark web had identified 3,897 customer records containing personally identifiable information. The bank received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).
According to the preliminary assessment, the exposed information reportedly included customers' names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. The records also contained branch details, Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan and lead records.
The potential exposure of such information raises concerns beyond the immediate safety of bank balances. Personal details can be exploited by cybercriminals to conduct targeted phishing campaigns, impersonate customers, create fraudulent communications or attempt to obtain additional confidential information. The combination of contact details and financial-related records may also increase the risk of social-engineering attacks, in which criminals deceive individuals into disclosing passwords, one-time passwords or other sensitive credentials.
SBI said it had promptly activated its cyber incident response and containment protocols after receiving the alerts. It has also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the nature and extent of the suspected compromise.
The investigation is expected to establish the authenticity and completeness of the records, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank. The precise origin of the suspected leak and the full extent of the incident have not yet been conclusively established.
The bank has maintained that its core business operations continue normally and that there has been no material impact on its financial performance or business continuity. However, the assurance that customer balances are safe does not eliminate the need to establish how the personal information became exposed and whether additional protective measures are required.
The incident has also renewed questions about the cybersecurity challenges facing India's financial sector, where banks hold enormous quantities of sensitive personal and financial information. As digital banking becomes increasingly central to everyday transactions, institutions face growing pressure to strengthen data protection, monitor suspicious activity and respond rapidly when information is suspected of being compromised.
For customers, vigilance remains important while the investigation continues. Account holders should be cautious about unexpected calls, messages or emails claiming to come from the bank, avoid sharing one-time passwords or PINs, and use official SBI channels to verify suspicious communications. Customers should also monitor their accounts and report any unauthorised transactions immediately.
SBI has reiterated its commitment to safeguarding customers' interests and implementing appropriate remedial and preventive measures. The central question now is not only whether customers' funds remain secure, as the bank maintains, but also how the suspected exposure occurred and what further steps will prevent similar incidents in the future.
