What happened
State Bank of India (SBI) has told stock exchanges that some of its customer data has surfaced on the dark web. The disclosure came on Wednesday, October 21, five days after the bank was alerted by its threat intelligence providers, the Defence Cyber Agency and CERT-In.
The claim first became public on October 16. Cybersecurity account CyberPulse56 said on X that a hacker group calling itself “Siriusim” had released 3.75 lakh rows of data and 2,722 PDF files linked to SBI. The group said the data included loan applications, account-opening forms and supporting documents. The authenticity of the claim remained unverified.
What SBI found
In its filing, the bank said it had examined about 3,75,000 records so far. Of these, 3,897 contained personally identifiable information (PII).
The exposed details include:
- Names, dates of birth and gender
- Registered mobile numbers and email addresses
- Residential addresses
- Branch and Customer Information File (CIF) identifiers
- Lead IDs and metadata linked to loan or lead records
SBI has activated its cyber incident response protocols and hired an independent cybersecurity firm empanelled with CERT-In. It said core operations and business continuity remain unaffected.
Why customers are at risk
The Internet Freedom Foundation (IFF) said the leak was public before SBI made any statement. It noted that no customer notice or advisory is publicly available for the 3,897 affected customers, despite an RBI advisory of March 2026 recommending that banks notify them.
The IFF warned that a caller who knows a customer’s name, date of birth, branch and loan details can easily pass as a bank official. Only a notice from the bank, it said, lets customers know to be on guard.
Subir Sangal, CEO, Eagle Information Systems, said:
“The SBI data breach is an indication that cybersecurity threats do not merely come through systems but through possible manipulation of each record stolen. In 2025, CERT-In dealt with more than 29.44 lakh cyber incidents, indicating the magnitude and persistence of the threats. Data leaks may trigger phishing attacks, identity theft, and highly sophisticated forms of social engineering, even in situations where there is no service disruption. In addition to securing their systems against cyberattacks, companies need to shift from perimeter security to continuous threat management, strong access control, and faster attack containment, which can be managed through a 24×7 Security Operations eCentre. Having a contingency plan for such an occurrence is also critical.”
Legal position
The IFF pointed to Section 8(6) of the Digital Personal Data Protection Act, 2023, which requires data fiduciaries to inform the Data Protection Board and affected individuals. Those provisions take effect only in May 2027. Until then, the bank’s obligations run to regulators: CERT-In within six hours and the RBI within two to six hours. A bank can meet all of these, the group said, and still leave customers uninformed.
The IFF has written to SBI’s chairman, with copies to the RBI governor and CERT-In’s director general. Its demands include direct notice to every affected customer, a helpline, clarity on whether Aadhaar, PAN or passport copies were exposed, disclosure of how the data left the bank, and assurance of compensation for any losses.
Major Vineet Kumar, Founder & Global President, CyberPeace Foundation, said:
“The SBI data exposure is a reminder that in banking, the consequences of a cyber incident extend well beyond the immediate loss of data. When personal identifiers, contact details and loan-related information are exposed together, they can provide fraudsters with the context needed to craft convincing impersonation attempts, targeted phishing messages and social engineering attacks. The priority must now be to establish the precise scope and source of the exposure, and assess potential downstream risks. Equally important is ensuring that potentially affected users are notified promptly and advised on precautions they can take to protect themselves. India’s Digital Personal Data Protection framework brings renewed focus to data fiduciary accountability and to individuals’ rights. The response must combine technical remediation with transparent communication and meaningful customer protection. Cyber resilience is measured not only by how quickly an institution responds, but by how effectively it prevents a breach from becoming a customer harm event.”
Political reaction
Congress Rajya Sabha MP Pawan Khera criticised the bank for failing to detect the breach itself, noting that an external agency had to alert it. He said SBI “owes its customers answers” and demanded accountability.
