The State Bank of India (SBI) has individually notified customers whose personal information was identified in a suspected cyber incident involving data reportedly found on the dark web. On Friday, October 23, 2026, the country’s largest public sector lender said it had informed all identified customers through email and/or WhatsApp, reiterating that their account balances and funds remained safe.
The update follows SBI’s preliminary analysis of approximately 3.75 lakh records, which identified 3,897 records containing personally identifiable information. The bank has initiated a detailed investigation and engaged an independent cybersecurity agency empanelled by the Indian Computer Emergency Response Team (CERT-In) to determine the nature and extent of the suspected exposure.
SBI has also urged customers to practise safe digital banking and remain alert to suspicious calls, messages and emails.
What Information Was Exposed?
In its latest communication, SBI confirmed that customers whose information was identified during the preliminary assessment had been contacted individually. “Further to our earlier post regarding the recent cyber incident, the Bank has individually informed all customers, whose data was identified as being involved, through email and/or WhatsApp,” the bank said. It reiterated: “We reiterate that your account balances and funds are safe with us.”
The clarification is intended to address concerns about the security of customers’ money while the investigation continues. According to SBI’s disclosure, the preliminary analysis covered approximately 3,75,000 records reportedly available on the dark web. Of these, 3,897 were identified as containing personally identifiable information (PII). The information reportedly included customers’ names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses.
The records also contained branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and other related files. However, the precise source of the suspected exposure, the authenticity and completeness of the data, and the full extent of the incident are still being examined. The identification of personal information in the records does not, by itself, establish that customers’ bank accounts have been accessed or that money has been stolen.
Investigation And Security Measures
The incident came to the bank’s attention on October 16, when SBI received alerts from its threat intelligence service provider, the Defence Cyber Agency and CERT-In regarding the suspected exposure of customer data on the dark web. The lender subsequently disclosed the incident in a regulatory filing, stating that a detailed investigation was necessary to establish the authenticity and completeness of the exposed records, identify the potential source of the exposure and assess the risks to customers and the bank.
SBI said it had promptly activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment. The bank also stated that the incident had not materially affected its core business operations, financial performance or business continuity, adding that its core banking functions continued to operate normally. The investigation is expected to help establish the circumstances surrounding the suspected data exposure and determine whether further remedial or preventive measures are required.
Meanwhile, SBI has advised customers not to share their one-time passwords (OTPs), personal identification numbers (PINs) or banking passwords with anyone. It has also urged them to remain vigilant about unsolicited communications. Customers should exercise particular caution if someone contacts them claiming to represent the bank and asks them to disclose confidential banking details or follow unfamiliar links. The bank’s advisory comes as the investigation into the incident remains ongoing, and its findings will be important in clarifying the potential risks arising from the exposure of personal information.
The Logical Indian’s Perspective
The SBI incident highlights the importance of protecting personal information in an increasingly digital banking environment. While the bank has assured customers that their balances and funds remain safe, the suspected exposure of personal details raises legitimate questions about data security, privacy and the safeguards financial institutions must maintain.
Personal information such as mobile numbers, residential addresses and loan-related details can potentially be misused for impersonation attempts or fraudulent communications, although the extent of any such risk in this incident has yet to be established. It is therefore important to distinguish between a suspected data exposure and a confirmed loss of money, while recognising that both financial security and the privacy of customer information deserve attention. SBI’s decision to notify identified customers and commission an independent assessment is a relevant step, but transparency about the investigation’s findings and any additional protective measures will remain important as more information becomes available.
Customers, too, can reduce their exposure to fraud by safeguarding their banking credentials, verifying suspicious requests through official channels and avoiding the sharing of sensitive information. At the same time, responsibility for cybersecurity should not rest on customers alone; financial institutions must continue strengthening their systems and communicating clearly when incidents occur. How can banks and customers work together to strengthen digital security while ensuring greater transparency and trust?
Also Read: At Least 4 Killed, Several Injured After Firecracker Factory Explodes In Bihar; Rescue Ops Underway
The State Bank of India (SBI) has individually notified customers whose personal data was identified in a recent cyber incident, assuring them that their account balances and funds remain safe. #SBI #StateBankOfIndia https://t.co/Kc2CoKXZTR
— All India Radio News (@airnewsalerts) October 24, 2026
