Technology / The SBI data leak dark web disclosure is now on the record: India's largest bank has told the stock exchanges that, inside a dataset of about 375,000 records circulating on the dark web, its early analysis found 3,897 customer records containing personal information. No passwords, PINs or stolen funds are listed in the filing. The real danger, experts warn, is not an emptied account. It is a phone call that knows your name, your branch and your date of birth — and sounds exactly like your bank.
The SBI data leak dark web story begins with a number that needs handling carefully. In a filing to the BSE and NSE on Wednesday, October 21, 2026, under Regulation 30 of the SEBI Listing Regulations, the State Bank of India (SBI) disclosed an incident involving the suspected exposure of customer data on the dark web. A preliminary analysis of about 375,000 records (3.75 lakh) circulating there identified 3,897 customer records containing personally identifiable information. Those are two very different numbers, and the distance between them is where this story lives.
What happened, and when
The timeline in SBI's filing is short and specific. On October 16, 2026, the bank received alerts from three sources: its threat intelligence service provider, the Defence Cyber Agency, and CERT-In, India's national computer emergency response team. Five days later, on October 21, SBI informed the exchanges — the disclosure a listed company owes its investors — and set out what its preliminary analysis had found.
The 3,897 confirmed records, according to the filing, contained names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch identifiers, CIF (customer information file) identifiers, lead IDs, and metadata associated with loan and lead records and related files. Read that list slowly, because its shape matters. This is not, on the filing's account, a dump of account credentials. It reads like the contact-and-enquiry layer of banking: who you are, how to reach you, which branch knows you, and that you were in the system as a loan customer or a loan lead.
Equally important is what the filing does not list. It does not list passwords, PINs or OTPs among the exposed fields, and it reports no stolen funds. SBI said core banking operations, financial performance and business continuity are not materially affected. It has activated its cyber incident response and containment process, and engaged an independent cybersecurity agency empanelled with CERT-In for a comprehensive assessment — authenticity and completeness of the data, its potential source, the extent of exposure, and the risks. Even the bank's own confirmed number is explicitly preliminary, and where the data came from is, on the record, still open.
Confirmed versus claimed: two stories, not one
What SBI has confirmed
Confirmed, because SBI itself filed it: alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency and CERT-In; a dataset of about 375,000 records circulating on the dark web; 3,897 customer records with personal information identified inside it on preliminary analysis; the field list above; no passwords, PINs or OTPs in that list; no stolen funds reported; no material effect on core banking, financial performance or business continuity, in the bank's assessment; and an independent CERT-In-empanelled investigation under way.
What has been claimed — and not confirmed by SBI
Separately, and strictly as a claim, a threat actor named "Siriusim" has claimed about 375,000 CSV rows plus 2,722 PDF documents — loan applications, supporting documents and account-opening forms — posted on BreachForums, a forum where stolen data is traded. The claim was flagged on October 16 by the X account CyberPulse56. The Free Press Journal examined sample records and found the phone numbers appeared real. Inc42 said it could not independently verify the claim.
The distinction is not pedantry, and this article will hold it throughout. SBI's filing does not attribute the incident to Siriusim, and it does not confirm the 2,722 PDF documents. Sellers of stolen data have every incentive to inflate what they hold: a bigger, scarier dump commands a bigger price. The circulating dataset and the claimed BreachForums material may be the same thing, partly the same thing, or different things wearing the same headline — and the dataset may contain duplicates, other institutions' records or padding, one ordinary explanation for why a preliminary pass found confirmed SBI personal records in only a small fraction of it. None of that is known yet. Establishing authenticity, completeness, source and extent is precisely the independent assessment's job.
Why this matters
It matters first because of what kind of data this is. A password can be changed. A date of birth cannot. A mobile number, a home address, a branch, a CIF identifier and the knowledge that a person enquired about a loan form a kit for impersonation that stays useful for years. The harm channel here is not, on anything in the current record, direct account theft — no credentials are listed, and no funds are reported stolen. It is a fraudster who no longer has to guess. A caller who knows your name, your branch, your date of birth and that you pursued a loan does not sound like a stranger; he sounds like the bank's loan desk following up. Every anti-fraud message banks send assumes the customer can tell the real bank from a fake one. Data like this is valuable precisely because it blurs that line.
It matters second because of who holds the data. SBI is India's largest bank and its largest public-sector lender; for a very large share of Indian households it is not one bank among many but the bank — where a salary lands, a pension is paid, a first loan is discussed. An incident disclosed to a stock exchange before it is explained to the people in the dataset tests that trust in a specific way: the market learns first, by law, and the customer learns from the news. And it matters third because it has landed in a legal gap — the rules about telling regulators are clear, while the rules about telling you are, for now, not in force. That gap, examined below, may be the most consequential part of this story.
Context and background: an incident in a rising tide
SBI's disclosure does not arrive in a quiet year. CERT-In handled 2,944,248 cyber security incidents in 2025, up 44 percent on 2024, according to ThreatAtlas India citing CERT-In's counts. Nor is an exchange cyber disclosure unusual any more: 19 Indian listed companies disclosed a cyber incident to the NSE in the 12 months to October 21, 2026. ThreatAtlas India adds a detail that reframes claims like the one attached to this dataset: 15 of those 19 companies never appeared on any ransomware leak site at all. Disclosure and dark-web boasting are different channels, overlapping far less than the news cycle suggests — one more reason to keep filed facts and a forum poster's claims in separate boxes.
The pattern is global. In the eMudhra certificate-keys incident, the failure was in how trust itself was manufactured; in the PHP2Shell emergency patch, in the plumbing under millions of websites; in the AI-driven attacks on South Korean banks, attackers industrialised the intrusion side. The SBI case is the fourth face of the same year: the data itself, already outside and circulating in a market, where the contest is about how much damage escaped information can do, and for how long.
The numbers in context
Three numbers do the work in this story, and each needs its qualifier. About 375,000 is the size of the dataset SBI says was circulating — records, not customers, and a dataset whose authenticity and completeness the bank's investigators have yet to certify. It is not, and must never be reported as, "375,000 customers affected." Records are not unique people: one person can generate several records, and a lead record can belong to someone who never became a customer.
3,897 is the count of customer records with personal information that SBI's preliminary analysis actually identified inside that dataset — roughly 1 percent of the circulating records, a ratio that cuts both ways. The confirmed exposure today is far narrower than the headline dataset implies; the other 99 percent is unexplained rather than exonerated, and the comprehensive assessment could move the figure either way. The honest sentence is the narrow one: as of October 21, 3,897 records are confirmed; the rest is under investigation.
2,722 — the claimed PDF documents — belongs entirely to the unconfirmed column. If genuine loan applications and account-opening forms were among the material, the sensitivity would step up sharply, because such files can carry identity documents. That is why the Internet Freedom Foundation's demands, below, ask directly whether KYC documents — Aadhaar, PAN or passport copies — are included. Today nobody outside the investigation can answer it, and SBI has not confirmed the PDFs exist in the dataset at all.
Who benefits, who loses — and what the critics are demanding
The losers start with the people in the 3,897 confirmed records, whose exposure is not hypothetical, and extend to every SBI customer who must now treat a plausible phone call as a potential attack — a tax on attention falling hardest on the elderly, on first-time borrowers, and on anyone whose loan enquiry makes the impersonation script write itself. The bank loses something less tangible: it disclosed promptly to the exchanges, as the law requires, yet the first public draft of this story was written by a forum claim flagged on social media the day the alerts arrived. Whoever trades in stolen data benefits twice — once if the data sells, and again from the fear a large round number generates, itself a marketing asset for the next dump.
The sharpest criticism has come from the Internet Freedom Foundation (IFF), aimed less at the breach than at the silence a customer is legally owed. The IFF demands SBI notify each affected customer directly — by SMS, email and letter, in English, Hindi and the customer's branch language — stating what data was exposed and what steps to take. It wants a dedicated helpline and an online facility to check whether one's data is affected; a statement of what the 375,000 records and 2,722 documents contain, how many customers they relate to, and whether KYC documents such as Aadhaar, PAN or passport copies are included; and, when the investigation concludes, disclosure of how the data left SBI's systems — including whether via a vendor or a direct selling agent — plus a published summary of the agency's findings. That last demand underlines a discipline kept throughout this article: the source is a hypothesis the investigation must test, not a finding anyone is entitled to today.
The IFF's wider demands are aimed at the system: the Reserve Bank of India should direct regulated entities to notify customers within a fixed period, and MeitY should bring India's data-protection provisions into force immediately. The reason, as the IFF lays it out, is a genuine legal gap. Section 8(6) of the Digital Personal Data Protection (DPDP) Act 2023, with Rule 7 of the DPDP Rules 2025, would require notifying both the Data Protection Board and each affected person — but staggered commencement means those provisions take effect only on May 13, 2027. Today's live obligations run the other way: the CERT-In Directions of April 28, 2022 and the RBI's cyber-security framework require reporting to regulators, and listing rules require informing the exchanges. No law in force clearly binds a bank to inform the people whose data it holds. SBI has complied with the duties that exist; the critics' point is that the duty that matters most to a customer is the one that does not yet.
Balance requires the other side too. Premature notification has real costs: alerting people before authenticity is established can trigger panic, can be exploited by the very phishers it warns against — a fake "check whether you are affected" page is the oldest trick in this economy — and can misidentify who is affected while matching is still preliminary. SBI's position, implicit in its filing, is that of an institution mid-investigation: contain, appoint an independent assessor, disclose what is confirmed, do not speculate. Both truths hold at once — the sequencing may be defensible, and a customer whose date of birth and branch are circulating still deserves, soon, a letter that says so.
What SBI customers should do now
Guidance from experts and outlets covering the incident, including Moneycontrol, starts with what not to do: do not panic, and do not close your account — nothing in the filing suggests accounts are compromised, and no funds are reported stolen. Never share an OTP, PIN or password with anyone, on any call, for any reason; the bank does not ask for them.
Treat unsolicited calls as the threat they now are. A caller who knows your name, branch, date of birth or loan enquiry has proved only that he has read a leaked record — hang up, and call the bank yourself on the number printed on your card. Do not click KYC-update or account-unblock links; that is the standard delivery mechanism for the fraud this data enables. Watch your statements, and check for unfamiliar loan accounts or credit enquiries in your name. If fraud reaches you, speed is the remedy: report it on the national cybercrime helpline, 1930, or at cybercrime.gov.in, and report phishing to report.phishing@sbi.co.in.
What happens next
Three scenarios cover the plausible futures. In the contained scenario — the one SBI's filing is written to support — the assessment confirms a narrow exposure close to the preliminary count, no KYC document trove materialises, and the incident becomes a case study in lead-pipeline hygiene rather than a mass breach; fraud attempts spike briefly on publicity and fade as the data ages. In the messy-middle scenario, the assessment revises the confirmed count upward or confirms genuine loan-file documents were circulating; customer notification then becomes politically unavoidable even where not yet legally required, and the May 2027 DPDP start date becomes an argument the government has to answer rather than a calendar entry.
In the adverse scenario, the data is put to work at scale — coordinated impersonation campaigns using branch and loan details, turning an information incident into a consumer-harm event — or the exit point is traced to a vendor or sales channel whose other banking clients must then ask the same questions about their own pipelines. There is no evidence today for that scenario; it is included because the dataset's value to criminals, if genuine, lies exactly there. The events that will sort these futures are concrete: the agency's findings and whether SBI publishes a summary, any move to notify customers directly, any statement on whether identity documents were involved, and any RBI or CERT-In direction reaching beyond the bank. Until the first lands, the verified story remains a small confirmed core inside a large unconfirmed claim — and the most useful thing a customer can do is refuse to confuse the two.
Sources
Sources: The Hindu BusinessLine — SBI reports suspected exposure of customer data on the dark web (October 21, 2026); Inc42 — SBI flags exposure of 3,897 customer records on dark web; YourStory — SBI: 3,897 customer records, personal data and the dark-web hacker leak claim; Cyber Security News — SBI confirms data breach; ThreatAtlas India — SBI dark-web leak: context and disclosure data. SBI's October 21, 2026 Regulation 30 filing, as reported above.
Related
Related on Signal Post News: eMudhra's certificate keys were guessable in seconds — now Chrome is removing its root · PHP2Shell: the critical PHP flaw that forced an emergency patch · AI-driven attacks hit South Korean banks Hana and Shinhan