Nearly four thousand State Bank of India customers have had their names, dates of birth, addresses and loan details surface on the dark web, yet none appear to have been told so directly by the bank. SBI disclosed the incident to the BSE and NSE on 21 October 2026, five days after it first learned of the breach through its own threat intelligence vendor, the Defence Cyber Agency and CERT-In. The filing reassures investors that core operations remain unaffected. It says nothing about whether affected customers have been warned.
What the filing reveals, and what it omits
The Regulation 30 disclosure describes a preliminary review of roughly 3.75 lakh records found on the dark web, from which SBI identified 3,897 customer records containing personally identifiable information: mobile numbers, dates of birth, names, email addresses, residential addresses, branch and CIF identifiers, and metadata tied to loan and lead records. SBI says it has not yet confirmed the data's authenticity or traced its origin, and has engaged a CERT-In empanelled agency to investigate. A threat actor calling itself "Siriusim" had already claimed, in a post reported on 16 October, to have released 3.75 lakh rows of data along with 2,722 PDF documents linked to SBI, reportedly including loan applications and account opening forms. The gap between 3,897 identified records and the far larger dataset claimed by the attacker is left unexplained, as is the content of the PDF files, which typically accompany identity and address proofs.
A regulatory gap that outlasts the breach
India's incident-reporting architecture is built around regulators, not customers. CERT-In's 2022 directions require reporting within six hours; the RBI's cyber security framework for banks requires a similar window. Banks can satisfy both while saying nothing to the people whose data has leaked. The provision that would change this, Section 8(6) of the Digital Personal Data Protection Act, 2023, obliges a data fiduciary to inform affected individuals of a breach. It does not take effect until May 2027, under the government's staggered rollout of the Act. The RBI tried to close part of this gap on its own in March 2026, when its Department of Supervision issued an advisory recommending that regulated entities notify affected customers through SMS, email, app alerts and calls. The advisory is not binding, and SBI's filing gives no indication that it has been followed in this instance.
Why silence carries its own risk
Banking fraud in India increasingly relies on data that makes a scam call sound legitimate. A fraudster who already knows a customer's date of birth, branch, CIF number and loan details does not need to ask for an OTP to sound convincing; the familiarity itself is the deception. Standard advice to withhold passwords and one-time codes assumes customers can distinguish a genuine bank call from an impersonation. Leaked data erodes precisely that distinction, which is why notification is not a courtesy but a practical defence. SBI is not the only lender to face this problem: Bank of Baroda opened a forensic investigation in July 2026 after a compromised employee email account exposed internal data, suggesting the vulnerability is systemic rather than isolated.
What should happen next
A formal representation has been sent to SBI's Chairman, with copies to the RBI Governor and the Director General of CERT-In, asking SBI to act on several fronts:
- Notify every affected customer directly, in English, Hindi and the language of their home branch, explaining what was exposed and what to do.
- Open a helpline and online tool letting customers check whether their data is part of the exposed set.
- Clarify the full contents of the 3.75 lakh records and 2,722 documents, including whether Aadhaar, PAN or passport copies are involved.
- Disclose, once the investigation concludes, how the data left the bank and whether a vendor or agent was responsible.
- Confirm that customers who suffer financial loss will be compensated under the RBI's existing liability rules.
Until the DPDP Act's breach-notification provisions take effect, customers are left to rely on regulatory goodwill rather than legal obligation. SBI customers who receive calls or messages referencing personal or loan details should treat them with suspicion, remembering that the bank never asks for OTPs, passwords or PINs. Unauthorised transactions can be reported to SBI's helpline or email, and to the national cyber crime helpline at 1930 or cybercrime.gov.in.