For days, India’s largest lender had nothing to say. On Wednesday, it finally spoke. State Bank of India confirmed in a stock exchange filing that personal data belonging to 3,897 of its customers has been found exposed on the dark web, the bank’s first official acknowledgement of an incident that surfaced days ago.
The disclosure marks a sharp turn in a story that began on October 16, when the bank received alerts from three separate agencies about a suspected exposure of customer data. Out of roughly 375,000 records floating on the dark web, SBI’s preliminary analysis identified 3,897 records containing personally identifiable information linked to its customers.
What SBI told the exchanges
In its filing, SBI said the bank “experienced an incident involving the loss of certain data,” language that stops short of calling it a confirmed breach. The distinction matters. The bank has activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency empanelled by CERT-In to investigate what it calls the “alleged data compromise.”
SBI stressed that a detailed investigation is still required to establish the authenticity and completeness of the exposed data, identify its possible source, and determine the extent of the exposure.
What was actually exposed
According to the filing, the exposed records include:
- Customers’ names and gender
- Registered mobile numbers
- Dates of birth
- Email addresses
- Residential addresses
- Branch and Customer Information File (CIF) identifiers
- Lead IDs
- Metadata associated with loan and lead records and other related files
Notably, the filing’s list does not include passwords, PINs or one-time passwords, and SBI has not reported any loss of customer funds. The danger here is not someone logging into your account directly. It is someone knowing enough about you to convincingly pretend to be your bank.
How the alarm was raised
SBI said it received communications on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and the Indian Computer Emergency Response Team (CERT-In) about the suspected exposure.
The timing is uncomfortable for the banking sector. Just last week, CERT-In revealed that AI models had gained unauthorised access to confidential information held by some Indian organisations, with the targets understood to be largely in the financial sector. The agency did not name names, but the SBI disclosure lands squarely in that context.
What the bank is doing now
Beyond activating its incident response protocols, SBI has handed the investigation to an independent CERT-In-empanelled agency, which will assess the nature and extent of the alleged compromise and the risks to customers and the bank. The bank says remedial and preventive measures are already being put in place.
SBI also reassured customers and investors: the incident has had no material impact on its core operations, financial performance or business continuity, and services continue to run without disruption. The market seemed to agree, with SBI shares largely flat on Wednesday morning at around Rs 970 on the BSE.
Why 3,897 records still matter
On paper, 3,897 is a small fraction of 375,000. But in the hands of a fraudster, a few thousand complete identity profiles are a goldmine. With your name, mobile number, date of birth, address and loan details in hand, a scammer does not need to guess. They can call you, quote your actual loan application back to you, and ask for the OTP “to verify.” That is exactly how the most convincing banking frauds in India begin.
The inclusion of loan and lead metadata is the detail that should worry customers most. It suggests the exposed data looks like application-stage data, the kind collected when someone applies for a loan, which often passes through third-party service providers before reaching the bank’s core systems.
What SBI customers should do right now
- Never share OTPs, PINs or passwords. SBI will never ask for them on a call or SMS. Anyone who does is a fraudster, no matter how much of your personal data they quote.
- Treat unexpected calls about your loans with suspicion. If a caller references your real loan details, hang up and call the bank’s official helpline yourself to verify.
- Do not click links in unexpected SMS or WhatsApp messages claiming to be from SBI, especially ones warning that your account will be blocked.
- Watch your account statements for transactions you do not recognise, and report anything odd through official channels immediately.
Frequently asked questions
Has SBI confirmed a data leak?
The bank has confirmed a suspected exposure. In an October 21 exchange filing, SBI said 3,897 customer records with personal information were identified on the dark web, and an investigation is underway to verify the data’s authenticity and source.
What customer data was exposed?
Names, gender, mobile numbers, dates of birth, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan and lead records.
Were passwords or OTPs leaked?
The data listed in SBI’s filing does not include passwords, PINs or OTPs, and the bank has reported no loss of customer funds.
Are SBI’s banking services affected?
No. The bank says its core business functions are operating normally and the incident has had no material impact on operations or financial performance.
I am an SBI customer. What should I do?
Stay alert for phishing calls and messages, never share OTPs or PINs, and verify unexpected communications through official channels.
Informeia will track the CERT-In-empanelled agency’s findings and update this story as SBI’s investigation progresses.
