State Bank of India (SBI), the country's largest lender, has publicly confirmed that some of its customers' personal data is circulating on the dark web. In a disclosure to the BSE and NSE stock exchanges dated October 21, 2026, the bank said a preliminary review of about 375,000 records found 3,897 customer records that contain personally identifiable information (PII), meaning data that can be tied to a specific person.

The filing is short. It leaves several big questions open: where the data came from, who took it, how many distinct people are affected, and whether customers will be told. The person selling the data is making much larger claims than the bank has confirmed. Below is what is established, what is only claimed, and what customers and defenders should do.

What did SBI actually disclose?

The disclosure was filed under Regulation 30 of India's securities rules (SEBI's listing regulations), which require listed companies to report material events to the exchanges. It is titled "Incident involving Data Loss." According to the filing, on October 16, 2026 the bank received communications about suspected exposure of customer data on the dark web from three sources: its threat intelligence service provider, the Defence Cyber Agency, and CERT-In, India's national computer emergency response team.

The bank says its preliminary analysis of approximately 375,000 records found 3,897 customer records containing PII. The filing says the exposed fields reportedly include:

  • registered mobile numbers
  • names, dates of birth and gender
  • email addresses and residential addresses
  • branch identifiers and CIF (Customer Information File) identifiers, the bank's internal customer IDs
  • lead IDs and metadata tied to loan and lead records and related files

SBI says it has hired an independent CERT-In-empanelled agency, meaning one on CERT-In's approved list of auditors, to investigate. It also says the incident has had no material impact on its core business operations, financial performance or business continuity. The filing is signed by Aruna N. Dak, Deputy General Manager (Compliance & Company Secretary).

What is the attacker claiming?

The bank's filing names no attacker, forum or dataset. Outside reporting fills in some of that, but these details trace back to the seller's listing, not to SBI, and should be read as unverified claims.

According to The Hacker News, a monitoring account called CyberPulse56 posted on X on October 16, the same day SBI was alerted, about a claim by an actor using the name "Siriusim." The claim covered 375,000 CSV rows and 2,722 PDF files. The Free Press Journal reported on October 17 that Siriusim had posted the offer on BreachForums, a cybercrime forum known for trading stolen data. It described the material as 3.75 lakh records (one lakh is 100,000) plus 2,722 PDF documents, mostly loan applications, supporting documents and KYC (know-your-customer) records. The Free Press Journal's reporting framed the data as potentially linked to SBI's subsidiaries as well, and said it was unclear whether it belongs to SBI, a subsidiary or a third-party provider.

Siriusim posted four sample records. The Free Press Journal checked them and found the phone numbers were valid. In one case, a WhatsApp profile photo matched a photo in a KYC record. That shows at least some of the samples correspond to real individuals. As the Free Press Journal and The Hacker News both point out, it does not prove the whole dataset is genuine. The Free Press Journal said the authenticity of the full dataset and its origin were unconfirmed, and SBI had not responded when it published.

Why 375,000 and 3,897 are different numbers

Two figures in this story are easy to mix up. 375,000 is roughly the size of the dataset the seller advertised and the bank reviewed. 3,897 is the number of records the bank has so far found to contain customer PII. CyberPeace, an Indian cyber-safety nonprofit, made this distinction in an October 23 explainer: the 375,000 figure is the size of the dataset on offer, while 3,897 is the number of records the bank has so far found to hold real customer information. Dark Reading likewise noted that neither the 375,000 rows nor the 2,722 PDFs necessarily indicates the total number of people affected.

There are two more caveats. First, The Hacker News notes that the 3,897 figure is preliminary, and the bank has not said whether it means 3,897 distinct people. One customer could appear in several records. Second, The Hacker News and CyberPeace both note that the bank has not addressed the 2,722 PDFs the seller advertised, so that claim remains unverified. The Free Press Journal's description of the claimed material, loan applications, account-opening forms and KYC documents, suggests such files could be more sensitive than the fields listed in the filing, but only the seller has said they exist.

Dark Reading reported on October 23 that SBI told customers the incident affected "a very, very small number of customers."

What was not exposed, as far as anyone knows

According to The Hacker News, the categories in the filing do not include account numbers, balances, passwords, one-time passcodes (OTPs), card details, or PAN and Aadhaar numbers (India's tax ID and national biometric ID). That matters, because the confirmed fields are not enough on their own to take over an account.

They are, however, very useful for fraud. A name, mobile number, date of birth, home address, branch and a reference to a specific loan record are what a scammer needs to call someone pretending to be from the bank and sound convincing. Dark Reading quoted an independent security researcher saying that, if the data is genuine, the main risk is credible-sounding phishing, vishing and identity or loan fraud rather than direct account theft, and reported that experts warn India's active underground market for PII makes even small leaks like this serious.

Where did the data come from?

Nobody has said publicly. The filing does not identify the source, and none of the reports establish whether the data came from SBI's own systems, a subsidiary, a vendor, or another third-party handler of banking applications. The presence of "lead IDs" and loan-lead metadata among the exposed fields is consistent with the bank's lending and lead-handling workflows, though that is an inference, not a finding. That is the most we can say until SBI or its investigator reports more. The Hacker News also notes that the filing does not say whether affected customers will be notified.

SBI is not the first Indian state-owned lender to make this kind of disclosure recently. The Hacker News reports that Bank of Baroda told the exchanges on July 27 about a cyber-security incident in nearly the same words.

What It Means for Defenders

Who is affected. The bank has confirmed 3,897 customer records with PII so far. Customers with loan or lead records at SBI, and possibly at its subsidiaries if the seller's unverified claim holds, should assume their contact details may be in criminals' hands. This is not a software vulnerability. There is no patch to apply and no fixed version to upgrade to. The risk is targeted social engineering.

For SBI customers. CyberPeace's advice is practical:

  • Treat any call, SMS or WhatsApp message claiming to be from SBI as suspicious, especially if it mentions a loan, creates urgency or asks you to click a link. Knowing your details does not make the caller legitimate.
  • Keep transaction alerts switched on and check your statements regularly so you see unauthorized activity quickly.
  • Report unauthorized transactions to the bank and file a complaint through the national cybercrime portal or helpline 1930.

Since OTPs, passwords and card data are not among the listed fields, the most likely attack is a fraudster who already knows your details trying to talk you into handing over one of those. Never share an OTP, PIN or password with an inbound caller, however much they seem to know about you.

For security teams at banks, NBFCs and fintechs. The exposed fields here, lead IDs, loan-lead metadata and the PDFs the seller claims to have, relate to loan and lead records. That kind of data often passes to marketing partners, document processors and other third parties. Some lessons that apply regardless of where this leak started:

  • Map where lead and loan-application data, including uploaded KYC documents, is copied, exported or shared. Keep only what you need.
  • Make sure dark-web and threat-intelligence monitoring is wired into incident response. In this case the bank received alerts from its threat-intel provider and two government agencies on October 16, the same day the claim was flagged publicly on X.
  • Prepare customer-facing anti-impersonation messaging in advance. With a leak like this, the follow-on fraud can do more damage than the leak itself.

For everyone else. Until a seller's dataset is verified, treat its advertised size as marketing. Here the bank has confirmed about 1% of the roughly 375,000 records it reviewed as containing customer PII, and has said nothing yet about the claimed documents. Watch for SBI's investigation findings and any customer notification before drawing firm conclusions.

Sources