---
title: State Bank of India confirms customer data on the dark web: 3,897 records with PII found so far among about 375,000 leaked records | ctxsec
url: https://ctxsec.com/items/sbi-dark-web-customer-data-leak-oct-2026
description: "SBI told India's stock exchanges on Oct 21 that its threat-intel provider, the Defence Cyber Agency and CERT-In alerted it on Oct 16 to suspected customer data on the dark web. A preliminary look at about 375,000 records found 3,897 with personal data, including names, mobile numbers, dates of birth, addresses, CIF identifiers and loan/lead metadata. SBI says core operations are unaffected and an independent CERT-In-empanelled firm is investigating."
status: "confirmed (SBI Regulation 30 filing to BSE/NSE, Oct 21)"
published: 2026-10-21
---

> SBI told India's stock exchanges on Oct 21 that its threat-intel provider, the Defence Cyber Agency and CERT-In alerted it on Oct 16 to suspected customer data on the dark web. A preliminary look at about 375,000 records found 3,897 with personal data, including names, mobile numbers, dates of birth, addresses, CIF identifiers and loan/lead metadata. SBI says core operations are unaffected and an independent CERT-In-empanelled firm is investigating.

[← Cybersecurity News](/news) · [markdown](/items/sbi-dark-web-customer-data-leak-oct-2026.md)

confirmed (SBI Regulation 30 filing to BSE/NSE, Oct 21)

2026-10-21

### State Bank of India confirms customer data on the dark web: 3,897 records with PII found so far among about 375,000 leaked records

In a [Regulation 30 disclosure](https://www.bseindia.com/xml-data/corpfiling/AttachLive/e16e3a1a-ee15-4971-977c-5f9f6aef1fb9.pdf) dated Oct 21, State Bank of India says it "experienced an incident involving the loss of certain data". On **Oct 16** it received alerts from its threat intelligence provider, India's **Defence Cyber Agency** and **CERT-In** about suspected exposure of customer data on the dark web. In a preliminary analysis of **about 375,000 records**, SBI identified **3,897 customer records with personal data**: registered mobile numbers, dates of birth, names, gender, email and residential addresses, branch and CIF identifiers, lead IDs, and metadata from loan/lead records and related files.

SBI says it activated incident response and containment, engaged an independent CERT-In-empanelled firm to establish the source and extent, and that there is no material impact on core operations, finances or continuity. The source of the leak (for example a lead-management or partner system) has not been disclosed.

**Why it matters:** lead and loan metadata plus verified mobile numbers is ideal fuel for loan-offer and KYC-update phishing. If you serve Indian banking customers, expect SBI-themed smishing and vishing; SBI customers should treat unsolicited loan or KYC calls as suspect.

Sources: [SBI disclosure to BSE/NSE (PDF), Oct 21](https://www.bseindia.com/xml-data/corpfiling/AttachLive/e16e3a1a-ee15-4971-977c-5f9f6aef1fb9.pdf)