--- title: "State Bank of India confirms data loss after 3,… | Firevault" url: https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026 description: "State Bank of India has disclosed a data loss incident after a review of about 375,000 records found on the dark web identified 3,897 customer records…" lang: en-GB --- Breaking News Updated as information becomes available News · Breach Analysis · Breaking # State Bank of India confirms data loss after 3,897 customer records found on the dark web State Bank of India has disclosed a data loss incident after a review of about 375,000 records found on the dark web identified 3,897 customer records containing personal information. Investigators have yet to confirm the source. **Mark Fermor**CTO, CMO and Founder, Firevault Published 21 October 2026 · 3 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fsbi-confirms-data-breach-customer-records-dark-web-2026)Email A bank branch at night with a hand holding a smartphone showing an incoming call ## What happened State Bank of India (SBI) has disclosed a data loss incident in a stock exchange filing dated 21 October 2026, according to Cyber Security News. A preliminary review identified 3,897 customer records containing personally identifiable information on the dark web. SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about suspected exposure of customer information. Investigators reviewed approximately 375,000 records to reach the 3,897 figure. The larger number is a count of records, not of affected people, and may include repeated entries. ## What data may be affected According to the filing, the records reportedly included: - Names, gender and dates of birth - Registered mobile numbers, email addresses and residential addresses - Branch and customer information file identifiers and lead IDs - Metadata linked to loan records, lead records and related files The filing does not list passwords, PINs or one-time passwords, and it does not report any stolen funds. ## What is not yet known SBI says the authenticity, completeness and source of the data have still to be established. The filing does not identify an entry point, vulnerability, malware or compromised server, and it does not say whether core banking systems were breached. Earlier claims by an actor using the name Siriusim, involving 375,000 CSV rows and 2,722 PDF files, have not been linked to the incident by SBI. The bank says its services continue to operate normally, with no material impact on core operations, financial performance or business continuity (https://fire-vault.com/solutions/oss). ## The response so far SBI says it activated its incident response procedures and appointed an independent, CERT-In approved cyber security agency to investigate the source and scale of the exposure and the risk to customers. Remedial and preventive measures are being put in place as required. ## Why this matters The data reported here goes further than a contact list. Branch details and loan references can make fraudulent calls and messages sound genuine. Targeted phishing is a potential risk rather than a confirmed consequence, but customers should verify unexpected contact through official banking channels and never share PINs or one-time passwords. For organisations, the incident is a reminder that records such as lead files and loan metadata often sit in working systems long after they are actively needed. Data that remains permanently connected stays within reach. Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® from Firevault keeps dedicated copies of sensitive records physically disconnected by default, reachable only through an authorised, identity-verified session. It does not replace good security practice in live systems, but it reduces how much valuable data sits on a network path at any one time. _Source: Cyber Security News, "SBI Confirms Data Breach (https://fire-vault.com/learn/breaches): 3000+ Customer Records Exposed on Dark Web", 21 October 2026, reporting SBI's stock exchange filing. Firevault has not independently reviewed the filing._ ## Questions SBI said a preliminary review of about 375,000 records identified 3,897 customer records containing personally identifiable information. The filing does not list passwords, PINs or one-time passwords among the exposed information, and it does not report stolen funds. Verify unexpected calls or messages through official banking channels, avoid unfamiliar links, never share PINs or one-time passwords, and check statements for unauthorised transactions. ## Sources and reporting notes 1. cybersecuritynews.com (https://cybersecuritynews.com/sbi-confirms-data-breach/)Primary reporting referenced in this analysis. Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More breach analysis - Breach Analysis · 21 Oct 2026**Cyberattack on cloud provider Arcadia may expose data of 125,000 Japanese police officers and staff**_Read the analysis_: https://fire-vault.com/news/arcadia-cyberattack-japan-police-data-breach-2026 - Breach Analysis · 15 Oct 2026**EY data breach: client tax records exposed through a support platform**_Read the analysis_: https://fire-vault.com/news/ey-data-breach-client-tax-records-october-2026 - Breach Analysis · 12 Oct 2026**ASOS data breach: stolen customer profiles and a hijacked app notification**_Read the analysis_: https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 - Breach Analysis · 25 Sept 2026**Dyfed-Powys Police confirms cyber attack as staff information may have been compromised**_Read the analysis_: https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 - Breach Analysis · 22 Sept 2026**FBI investigates claims that hackers stole personnel and applicant data**_Read the analysis_: https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 - Breach Analysis · 20 Sept 2026**Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later**_Read the analysis_: https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into ten Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026#webpage", "url": "https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026", "name": "State Bank of India confirms data loss after 3,…", "description": "State Bank of India has disclosed a data loss incident after a review of about 375,000 records found on the dark web identified 3,897 customer records…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/sbi-data-breach-dark-web-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "State Bank of India confirms data loss after 3,897 customer records found on the dark web", "item": "https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "State Bank of India confirms data loss after 3,897 customer records found on the dark web", "description": "State Bank of India has disclosed a data loss incident after a review of about 375,000 records found on the dark web identified 3,897 customer records containing personal information. Investigators have yet to confirm the source.", "url": "https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026", "image": [ { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/sbi-data-breach-dark-web-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/sbi-data-breach-dark-web-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/sbi-data-breach-dark-web-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/sbi-data-breach-dark-web-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-10-21T06:30:00+00:00", "dateModified": "2026-10-21T08:39:51.296886+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 478, "keywords": "State, Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "## What happened State Bank of India (SBI) has disclosed a data loss incident in a stock exchange filing dated 21 October 2026, according to Cyber Security News. A preliminary review identified 3,897 customer records containing personally identifiable information on the dark web. SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and t", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "How many SBI customer records were found?", "acceptedAnswer": { "@type": "Answer", "text": "SBI said a preliminary review of about 375,000 records identified 3,897 customer records containing personally identifiable information." } }, { "@type": "Question", "name": "Were passwords or PINs exposed?", "acceptedAnswer": { "@type": "Answer", "text": "The filing does not list passwords, PINs or one-time passwords among the exposed information, and it does not report stolen funds." } }, { "@type": "Question", "name": "What should SBI customers do?", "acceptedAnswer": { "@type": "Answer", "text": "Verify unexpected calls or messages through official banking channels, avoid unfamiliar links, never share PINs or one-time passwords, and check statements for unauthorised transactions." } } ] } ] ```