State Bank of India (SBI) has confirmed that 3,897 customer records were exposed on the dark web. The bank notified stock exchanges of the incident, which is now under investigation by a cybersecurity firm. While the bank states core operations remain stable, the leak of personal data poses ongoing risks for affected customers.
State Bank of India (SBI) has formally notified the NSE and BSE regarding a data security incident that resulted in the exposure of 3,897 customer records on the dark web. The bank initiated its response protocols after receiving alerts on October 16, 2026, from threat intelligence providers, including the Defence Cyber Agency and CERT-In. Following a preliminary analysis of approximately 375,000 records, the bank identified the specific 3,897 files containing personally identifiable information.
Nature of the Data Incident
The exposed data includes customer names, registered mobile numbers, dates of birth, email addresses, residential addresses, and metadata associated with loan and lead records. Upon identifying the breach, SBI engaged an independent, CERT-In-empanelled cybersecurity agency to conduct a forensic assessment. The primary goal of this investigation is to trace the entry point of the unauthorized access and ensure no further exposure has occurred.
The bank has clarified that the incident has not materially impacted its core business operations, financial stability, or system continuity. However, for customers, the exposure of such details increases the risk of phishing, impersonation, and fraudulent loan attempts. While the bank's central systems remain secure, data circulating on the dark web can be misused for social engineering attacks targeting bank users.
Financial Context Amid Security Concerns
This incident comes against the backdrop of a strong quarterly performance for the lender. In its report for the second quarter ending September 30, 2026, SBI posted a standalone net profit of ₹23,038 crore, representing a 14% year-on-year growth. The bank’s asset quality has shown consistent improvement, with gross non-performing assets (GNPA) falling to 1.39% from 1.73% in the same quarter last year. Provisions for bad loans were also reduced to ₹2,759 crore, reflecting a healthier balance sheet.
What Investors and Customers Should Monitor
For investors, the immediate financial stability of the bank appears unaffected by this specific data leak. However, regulatory scrutiny regarding cybersecurity standards for major financial institutions remains high. The key monitorable for stakeholders will be the findings of the forensic investigation and any follow-up actions mandated by regulators or the bank to strengthen digital security.
Customers are advised to remain cautious regarding unsolicited calls, messages, or emails requesting sensitive financial information, as the leaked data may be used for targeted phishing campaigns. The bank is expected to provide further updates as the forensic audit progresses and security gaps are addressed.