State Bank of India confirmed a cybersecurity incident involving the exposure of 3,897 customer records containing personally identifiable information. The bank stated there is no material impact on core operations or financial performance as investigations continue.
State Bank of India Reports Customer Data Exposure
3,897 customer records exposed; 375,000 records analyzed in preliminary review.
Reader Takeaway: Bank claims no material financial or operational impact, but investigations into the data breach are ongoing.
What just happened
State Bank of India (SBI) disclosed on October 21, 2026, that it detected a data exposure incident involving customer information found on the dark web. The bank was alerted to the situation on October 16, 2026, by the Defence Cyber Agency, CERT-In, and its own Threat Intelligence Service Provider. An initial analysis revealed that 3,897 records containing personally identifiable information (PII) were compromised out of 375,000 records scanned.
Scope of Exposure
The leaked data includes sensitive details such as customer names, dates of birth, gender, registered mobile numbers, email addresses, and residential addresses. Additionally, branch and CIF identifiers along with lead IDs and associated metadata related to loan records were also involved.
Remedial Measures
SBI immediately activated its cyber incident response and containment protocols upon receiving the alert. The bank has also appointed an independent, CERT-In-empanelled cybersecurity agency to conduct a thorough forensic investigation to determine the source of the leak and the full extent of the compromise.
Management Statement
Management has explicitly stated that the incident does not pose a material risk to the bank's core business operations, financial results, or business continuity. Core banking systems are operating normally. The bank continues to work with external experts to verify the authenticity and completeness of the compromised data.
Risks to watch
Investors should monitor the situation for any subsequent regulatory feedback or findings from the independent investigation that may contradict the bank's current assessment. Cybersecurity events carry inherent reputational risks that can influence investor sentiment regardless of immediate financial impact.
What to track next
Key focus areas include any further disclosures from the bank regarding the outcome of the forensic audit and any updates provided to the Reserve Bank of India or other relevant cybersecurity oversight bodies.