Data on dark web spurs probe by Indian bank

By the Editorial Team · Thursday, October 22, 2026

State Bank of India identified nearly 3,900 customer records containing personally identifiable information potentially exposed on the dark web and has launched a thorough investigation. The bank is working with a certified cybersecurity agency to assess the breach’s scope and implement measures to protect customer data while maintaining uninterrupted business operations.

State Bank of India (SBI) announced on Tuesday that it has identified nearly 3,900 customer records containing personally identifiable information (PII) as part of a preliminary review of data suspected to have been exposed on the dark web. The discovery prompted the bank to launch a detailed investigation into the incident.

The alert emerged on October 16 when SBI received notifications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and India's Computer Emergency Response Team (CERT-In) concerning a possible data breach involving customer information appearing on the dark web. The bank’s initial analysis examined approximately 375,000 records found online, of which 3,897 were confirmed as belonging to SBI customers.

According to SBI, the exposed data includes registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, as well as branch details, customer information file (CIF) identifiers, lead IDs, and metadata related to loan and credit records. The bank emphasized that the preliminary findings do not yet confirm the authenticity or completeness of the data, stressing that further investigation is necessary to determine the source, scope, and potential risks associated with the exposure.

SBI stated that it promptly activated its cyber incident response and containment protocols following receipt of the alert. The bank has also engaged an independent cybersecurity agency accredited by CERT-In to conduct a comprehensive evaluation of the breach, including a detailed assessment of the nature and extent of the suspected compromise.

The ongoing investigation aims to inform the implementation of appropriate remedial and preventive measures, SBI said. The bank reassured customers and stakeholders that the incident has not materially impacted its core business operations, with all essential functions continuing without disruption.

SBI continues to monitor the situation closely and said it remains committed to protecting customer data and ensuring business continuity amid the inquiry. Further updates will be provided as more information becomes available.

This article was reported by synthesizing coverage from multiple independent news outlets to present a balanced, unbiased account. Read about our editorial standards. Spotted an error? Let us know.