News in Short

• SBI identified 3,897 customer records containing personal information during a review of around 375,000 records found on the dark web.
• The bank received alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency and CERT-In.
• The exposed records reportedly contain contact details, customer identifiers and information linked to loan and lead records.
• SBI has appointed an independent cybersecurity agency to investigate the suspected exposure and trace the source.
• The bank says its core banking operations continue normally, with no material impact on its financial performance or business continuity.
• Customers should watch for targeted calls, fake bank messages and phishing attempts that use personal details to appear genuine.

State Bank of India (SBI) is investigating a suspected data exposure after identifying personal information in 3,897 customer records found on the dark web. The bank disclosed the incident in a stock exchange filing dated October 21, 2026.

SBI said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). The bank then reviewed around 375,000 records found on the dark web.

Its initial assessment identified 3,897 records containing personal information. These reportedly included names, dates of birth, gender, registered mobile numbers, email addresses and home addresses. The records also contained branch details, Customer Information File identifiers, lead IDs and metadata linked to loans and customer leads.

However, the bank has not yet established the complete scope or origin of the suspected exposure. It is checking whether the records are genuine, how much information was affected and what risks the incident could create.

SBI has activated its cyber incident response procedures and appointed an independent cybersecurity agency empanelled by CERT-In. The investigation aims to establish the source of the data and identify appropriate corrective measures.

Does the SBI incident mean customer bank accounts are compromised?

Not necessarily. The reported exposure involves customer information, but the available details do not establish that attackers accessed banking credentials, passwords, PINs or transaction systems.

SBI has also said the incident has not materially affected its financial performance, core banking operations or ability to continue services. Its banking functions are reportedly running normally.

Customers should therefore distinguish between a suspected exposure of personal information and a confirmed compromise of bank accounts. The investigation is ongoing, and the full impact remains unclear.

Nevertheless, exposed personal information can create opportunities for fraud. Scammers may use genuine names, phone numbers, addresses or banking-related details to make fraudulent calls and messages sound credible.

For example, a caller might claim to represent SBI’s fraud department and mention a customer’s branch or loan details. They may then ask the customer to verify an account, share an OTP or install an application. Familiar details can make such requests appear legitimate, but they do not prove that the caller represents the bank.

How can exposed customer data lead to banking fraud?

Personal information can help criminals make phishing attempts more convincing. Instead of sending generic messages, scammers can tailor their approach to a particular customer.

A fraudster might claim that a loan application needs urgent verification, a bank account faces suspension or a suspicious transaction requires immediate action. Fake KYC updates, account-blocking warnings and fraudulent reward offers are other common approaches.

Some scammers may also impersonate bank employees, police officers or government officials. They can use urgency and threats to pressure victims into sharing confidential information or transferring money.

Importantly, the presence of customer records on the dark web does not automatically mean every affected customer will face fraud. It does, however, give customers a reason to be cautious about unexpected banking communications.

Seven ways SBI customers can protect themselves

1. Never share OTPs, PINs or passwords. Do not disclose your internet banking password, ATM PIN, CVV or OTP to anyone claiming to represent SBI. Treat requests for these details as a major warning sign.

2. Verify unexpected calls independently. If someone claims to be an SBI employee, end the call and contact the bank through its official website, verified app or the number printed on your bank documents. Do not rely on a number supplied by the caller.

3. Avoid links in unsolicited messages. Do not click links in unexpected SMS messages, emails or WhatsApp chats claiming to offer KYC updates, refunds or account verification. Open the official banking app or enter the bank’s website address yourself.

4. Never install apps at a caller’s request. Fraudsters may ask customers to install remote-access or screen-sharing applications to resolve supposed banking problems. Such access can expose sensitive information and help criminals take control of transactions.

5. Check account activity and transaction alerts. Review recent transactions and keep SMS or app notifications enabled. Contact the bank immediately if you notice an unfamiliar transaction, a suspicious login alert or an unexpected change to your account details.

6. Secure your digital banking access. Use a unique, strong password for internet banking and secure the email account linked to your bank. Never reuse banking passwords across websites. Keep your phone’s operating system and banking applications updated.

7. Treat urgency as a warning sign. Scammers often claim that an account will be blocked unless you act immediately. Do not transfer money to a so-called safe account, approve an unfamiliar payment request or share confidential details to avoid a threat.

These precautions are useful even for customers who have not been identified as part of the reported records. The investigation has not established that all SBI customers are affected.

What should you do if you suspect banking fraud?

Act quickly if you receive a suspicious message, disclose sensitive information or notice an unauthorised transaction.

Contact SBI through an official channel and ask the bank to secure the affected account or banking access. Follow its instructions to block compromised cards or credentials, where necessary.

If money has been lost to cyber fraud, call India’s cybercrime helpline at 1930 as soon as possible. You can also report the incident through the official National Cyber Crime Reporting Portal at cybercrime.gov.in. Preserve transaction references, messages, phone numbers and other evidence that may help investigators.

Do not pay anyone who promises to recover stolen money for an advance fee. Recovery scams often target people who have already lost money.

Customers who receive suspicious calls should also avoid sharing additional information simply because the caller knows their name, address or bank-related details.

What happens next in the SBI investigation?

SBI’s independent cybersecurity review is expected to help establish the source, authenticity and scope of the suspected data exposure. The bank has said it is working on remedial and preventive measures in line with regulatory requirements.

Until more details emerge, customers should avoid assuming that their accounts have been compromised. They should also avoid dismissing suspicious communications simply because their banking services continue to function normally.

The key takeaway is straightforward: the reported exposure is still under investigation, but customers can reduce their risk by verifying communications independently, protecting their credentials and reporting suspicious transactions without delay.

For now, awareness and caution remain the most practical ways to stay ahead of fraud.