What happened
State Bank of India disclosed on 21 October 2026 that 3,897 customer records containing personally identifiable information were identified among roughly 375,000 dark web records following a 16 October alert from the Defence Cyber Agency and CERT-In.
Why it matters
Affected customers' names, mobile numbers, dates of birth, email addresses, and residential addresses are now in circulation, raising the risk of phishing and identity theft.
Remember this
3,897 SBI customer records leaked on the dark web
What SBI Confirmed
SBI stated the following in its stock exchange filing on 21 October 2026.
- 3,897 customer records with PII identified from approximately 375,000 dark web records
- Alert received from the Defence Cyber Agency and CERT-In on 16 October 2026
- Independent CERT-In empanelled cybersecurity agency engaged for comprehensive assessment
- No material impact on core operations, financial performance, or business continuity
More context & who is affected
SBI disclosed on 21 October that 3,897 customer records with names, mobile numbers, and addresses surfaced on the dark web after a 16 October alert from the Defence Cyber Agency and CERT-In.
A preliminary review of about 375,000 dark web records identified the SBI data, which included dates of birth, email addresses, branch identifiers, and loan metadata.
The bank said it activated incident response protocols and engaged an independent cybersecurity agency, adding that core operations and financial performance remain unaffected.
- PII records identified
- 3,897 3,897 customer records containing PII were identified from dark web data.The Indian ExpressThe Economic Times
- Records reviewed on dark web
- 375,000 A preliminary analysis reviewed approximately 375,000 records available on the dark web.The Economic Times
- Alert received date
- October 16, 2026 SBI received alerts from the Defence Cyber Agency and CERT-In on 16 October 2026.The Economic Times
General Public
3,897 SBI customers' personal data including names, mobile numbers, dates of birth, email addresses, and residential addresses are circulating on the dark web.
General Public · Business Executives
Exposed customer records raise the risk of targeted phishing, identity theft, and social engineering attacks against SBI account holders.
Reporting fromThe Indian Express ↗The Economic Times ↗
Sources & verification2 sources · 4 claims
These are the records behind this briefing. Linked reporting is not the same as independent confirmation.
- The Indian ExpressReporting
State Bank of India reports cyberattack involving nearly 3900 customer records ↗
Published Oct 21, 2026 · Accessed Oct 22, 2026 - The Economic TimesReportingPublished Oct 21, 2026 · Accessed Oct 22, 2026
Claims and linked sources
SBI reported a cyberattack in which 3,897 customer records containing personally identifiable information were exposed on the dark web.
On 16 October 2026, SBI received communications from the Defence Cyber Agency and CERT-In regarding suspected exposure of customer data on the dark web.
The exposed data included customer names, mobile numbers, dates of birth, email addresses, residential addresses, and branch identifiers.
SBI stated the incident would not have any material impact on core business operations, financial performance, or business continuity.