News · Breach Analysis · Breaking

State Bank of India confirms data loss after 3,897 customer records found on the dark web

State Bank of India has disclosed a data loss incident after a review of about 375,000 records found on the dark web identified 3,897 customer records containing personal information. Investigators have yet to confirm the source.

What happened

State Bank of India (SBI) has disclosed a data loss incident in a stock exchange filing dated 21 October 2026, according to Cyber Security News. A preliminary review identified 3,897 customer records containing personally identifiable information on the dark web.

SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about suspected exposure of customer information. Investigators reviewed approximately 375,000 records to reach the 3,897 figure. The larger number is a count of records, not of affected people, and may include repeated entries.

What data may be affected

According to the filing, the records reportedly included:

• Names, gender and dates of birth
• Registered mobile numbers, email addresses and residential addresses
• Branch and customer information file identifiers and lead IDs
• Metadata linked to loan records, lead records and related files

The filing does not list passwords, PINs or one-time passwords, and it does not report any stolen funds.

What is not yet known

SBI says the authenticity, completeness and source of the data have still to be established. The filing does not identify an entry point, vulnerability, malware or compromised server, and it does not say whether core banking systems were breached. Earlier claims by an actor using the name Siriusim, involving 375,000 CSV rows and 2,722 PDF files, have not been linked to the incident by SBI.

The bank says its services continue to operate normally, with no material impact on core operations, financial performance or business continuity.

The response so far

SBI says it activated its incident response procedures and appointed an independent, CERT-In approved cyber security agency to investigate the source and scale of the exposure and the risk to customers. Remedial and preventive measures are being put in place as required.

Why this matters

The data reported here goes further than a contact list. Branch details and loan references can make fraudulent calls and messages sound genuine. Targeted phishing is a potential risk rather than a confirmed consequence, but customers should verify unexpected contact through official banking channels and never share PINs or one-time passwords.

For organisations, the incident is a reminder that records such as lead files and loan metadata often sit in working systems long after they are actively needed. Data that remains permanently connected stays within reach.

Offline Secure Storage® from Firevault keeps dedicated copies of sensitive records physically disconnected by default, reachable only through an authorised, identity-verified session. It does not replace good security practice in live systems, but it reduces how much valuable data sits on a network path at any one time.

Source: Cyber Security News, "SBI Confirms Data Breach: 3000+ Customer Records Exposed on Dark Web", 21 October 2026, reporting SBI's stock exchange filing. Firevault has not independently reviewed the filing.

Sources and reporting notes

1. cybersecuritynews.comPrimary reporting referenced in this analysis.

Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor.