SBI Data Leak: 3,897 Customer Records Found on the Dark Web. What Happened and What You Should Do Now

By Shuchi, FinanceChecks.com | Published 21 October 2026 | Last updated 21 October 2026 | Category: Banking Insurance and Loans | Reading time: about 10 minutes

Imagine Priya, a pharmacist in Lucknow, picking up a call from an unknown number at 7 in the evening. The caller is polite and calm. He says he is from the State Bank of India loan department, gives her full name, her date of birth, the name of her home branch, and mentions a loan enquiry she made a few months ago. Then he says there is a problem with her application and he needs an OTP to fix it before the file is cancelled.

Priya has never shared an OTP in her life. But the caller knew her branch and her birth date, and that is the moment most people’s guard drops. The scam does not work because people are careless. It works because a stranger sounds like someone who already knows you.

That is why the news that came out on 21 October 2026 matters well beyond SBI customers. The country’s largest bank has confirmed that customer records containing personal details were found on the dark web. This guide explains what has been confirmed, what is only a claim, what remains unknown, and the practical steps you can take today, whether or not you are an SBI customer.

Quick Answer

On 21 October 2026, State Bank of India told the stock exchanges that a preliminary review of about 3,75,000 records circulating on the dark web identified 3,897 customer records containing personal information. The bank received alerts on 16 October from its threat intelligence provider, the Defence Cyber Agency and CERT-In. The source, authenticity and full scale of the data are still under investigation by an independent CERT-In empanelled agency. SBI says core banking operations are not affected. The main risk to customers is phishing and impersonation, not direct theft, so never share an OTP, PIN or password, and verify any call or message about your account through official channels.

About This Guide

This article is written by the editorial desk of FinanceChecks.com, an independent Indian personal finance publication, to help ordinary bank customers understand a fast-moving cyber incident. It is based on SBI’s disclosure to the stock exchanges as reported by multiple news outlets on 21 October 2026, on reporting about the claims made online by a group calling itself Siriusim, and on a public statement from the Internet Freedom Foundation. The investigation is at an early stage, and facts may change. We have separated confirmed information from claims and unknowns, and we will update this article when the bank or regulators publish more. This is general information and not legal or financial advice.

What Happened: The Timeline

Date	What happened	Status
16 October 2026	SBI received alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In about customer data on the dark web	Confirmed by SBI
16 to 20 October 2026	A group calling itself Siriusim reportedly claimed to have released about 3.75 lakh rows of SBI data and 2,722 PDF documents, and published four sample records	Claim, reported by media and monitoring accounts
20 October 2026	Media reports on the hacker’s claim began to appear	Reported
21 October 2026	SBI filed a disclosure with BSE and NSE, saying it identified 3,897 customer records with personal information	Confirmed by SBI
Ongoing	Independent CERT-In empanelled agency assessing authenticity, source and scale	Under investigation

The Numbers, Explained Simply

You may see three different figures in headlines, and they are not the same thing.

The first is about 3,75,000. This is the number of rows or entries in the dataset that SBI examined. Reports note that a figure like this counts rows, which often include repeated data, and is not a confirmed count of separate individuals.

The second is 3,897. This is the number of customer records, out of that larger set, that SBI’s preliminary analysis found to contain personally identifiable information. This is the number the bank has confirmed.

The third is 2,722. This is the number of PDF documents, reportedly including loan applications and account opening forms, that the Siriusim group claimed to hold. SBI has not confirmed this figure, and the group’s claims have not been verified.

So the honest summary is this: nearly 4,000 customer records are confirmed to contain personal details, a much larger dataset is in circulation, and the real scale is not yet known.

What Information Was Exposed

According to SBI’s disclosure as reported, the exposed information included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan or lead records and related files.

None of the reported fields mention account passwords, PINs, card numbers or account balances. That is a reassuring detail, but it should not make you relax. The combination of a name, number, date of birth, address and branch is exactly what a scammer needs to sound like the bank.

What Is Still Not Known

There are several important questions without answers yet. SBI has not said how the data got onto the dark web. The investigation will look at whether it came from inside the bank’s own systems or from a vendor or partner that handled the data. The presence of lead IDs and loan-related metadata suggests the information may relate to loan enquiries or leads, but that is an observation, not something the bank has stated. SBI has also not formally attributed the incident to any group. Reports say the material appeared on a forum known for data-leak claims, but the bank has not confirmed that source or the authenticity and completeness of the data.

Is My Money at Risk?

Based on what has been reported, this does not look like a breach of customers’ bank accounts. Commentators have noted that the exposure of personal details does not automatically mean every SBI customer is affected or that anyone has accessed customers’ accounts. The more realistic risks are these.

Risk	How it can happen	How to stay safe
Phishing and vishing calls	A caller uses your real details to pose as the bank and asks for an OTP, PIN or card details	Never share these, whatever the caller knows about you
Fake loan or KYC messages	SMS or WhatsApp messages with links to fake SBI pages or apps	Do not click links, and do not install apps sent to you
Identity misuse	Your details used to apply for loans, SIM cards or services in your name	Check your credit report and watch for unknown accounts
Targeted loan scams	Fraudsters refer to a real loan enquiry and offer a quick approval for a fee	Pay no fee for loan approval, and verify through the branch

Anyone who recently applied for or enquired about a loan at SBI should be extra careful, simply because loan and lead records are among the reported data types. That is a precaution, not a confirmed finding about any individual.

A Gap Worth Noticing: Who Gets Told

The Internet Freedom Foundation has pointed out that SBI told the stock exchanges about the incident but has not told the customers whose data was involved. In its statement of 21 October, the organisation said the reporting duties currently in force, under the CERT-In Directions of 28 April 2022 and the RBI’s cyber security framework for banks, are owed to regulators and not to customers, and that no law in force clearly requires a bank to inform the people whose data it holds. It called for a dedicated helpline and an online facility for customers to check whether their data is affected, and for RBI to direct regulated entities to notify customers within a fixed period until the Digital Personal Data Protection Act comes fully into effect.

SBI has said it will continue to monitor the situation and take appropriate measures in line with applicable regulatory requirements. As of writing, I have not seen any official customer-facing lookup tool or helpline announced for this incident. That brings me to a warning. Be wary of any website, WhatsApp message or app that claims to tell you whether your SBI data was leaked. Fraudsters love a news story, and a fake “breach checker” that asks for your mobile number, OTP or card details is simply another trap.

What To Do Today: A Practical Checklist

Whether you hold an SBI account or not, these steps cost nothing and take about fifteen minutes.

1. Never share an OTP, UPI PIN, ATM PIN, CVV or net banking password with anyone, including someone who claims to be from the bank. Banks say they never ask for these.
2. If you receive a call about your account, loan or KYC, hang up and call the bank back on the number printed on your card, passbook or the official website. Do not use a number the caller or an SMS gives you.
3. Do not click links in messages about SBI, KYC updates, loan offers or account blocking. Open the bank’s official app or website yourself instead.
4. Do not install any app or file that someone sends you, especially files ending in apk, even if the message looks like it is from the bank.
5. Make sure SMS and email alerts are switched on for all transactions, so you notice anything unusual immediately.
6. Check your statements and recent transactions this week, and then once a month.
7. Review your credit report with a credit bureau. You are entitled to a free full credit report from each bureau at least once a year. Look for loans, cards or enquiries you do not recognise.
8. If your bank app offers card and UPI controls, such as limits or the ability to switch off online or international use, review them.
9. If you think you have been targeted, call your bank and report it on the national cyber crime helpline 1930 or at cybercrime.gov.in right away. Speed matters in recovering money.

Common Mistakes to Avoid

The most dangerous mistake is trusting a caller because he knows your details. After a leak, correct details prove nothing. Other mistakes include calling the “customer care” number shown in a search result or an SMS, because fake numbers are often promoted that way; paying a small processing fee for a loan or a refund; forwarding unverified lists or screenshots in family groups, which spreads panic and scams; and assuming that because you do not use SBI, none of this concerns you. Leaked details travel between criminals, and the same scripts are used for every bank.

My Take

I have written about fraud for a while now, and what strikes me about incidents like this is how small the technical part is compared with the human part. A few thousand records can fuel a long run of convincing calls. The leak is only the first half of the scam, and the second half depends on you picking up the phone and believing the voice.

I also think customers deserve better information. A bank that tells the stock market within days but gives customers no way to find out whether they are affected has the priorities the wrong way round, and the public should keep asking for a clear notification rule. At the same time, the bank has done what it should in the early hours: it acted on alerts, brought in an independent agency, and disclosed to the exchanges. The real test is what follows, which is a full account of the source, direct communication to affected customers, and a clear remedy.

Until then, treat every unexpected call about your bank account as hostile, however friendly it sounds. That one habit will protect you from this leak and the next one.

Frequently Asked Questions

1. What happened in the SBI data leak? On 21 October 2026, SBI told the stock exchanges that it had identified 3,897 customer records containing personal information in data circulating on the dark web. The bank received alerts about it on 16 October and has begun an investigation with an independent cybersecurity agency.

2. How many SBI customers are affected? SBI has confirmed 3,897 customer records with personal information. A larger set of about 3,75,000 rows was reviewed, but that figure counts entries and not confirmed individuals. The full scale is still being established.

3. What data was leaked? As reported from SBI’s disclosure, the data included names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and metadata linked to loan or lead records. Passwords, PINs and card numbers are not mentioned in the reported list.

4. Is my SBI account safe? Based on what has been reported, the incident involves personal details and not a confirmed breach of customer accounts, and SBI says core operations are unaffected. However, the details can be used for impersonation and phishing, so you should stay alert and avoid sharing OTPs or PINs.

5. How do I know if my data was leaked? At the time of writing, no official customer lookup tool has been announced. Be cautious of websites or messages that claim to check this for you, since many are scams. Watch for suspicious calls, messages or unexplained activity, and contact your bank through official channels if you are concerned.

6. Who is Siriusim? Siriusim is the name used by an anonymous group that claimed online to have released about 3.75 lakh rows of SBI data and thousands of documents. SBI has not attributed the incident to any group, and the group’s claims have not been independently verified.

7. What should I do if I get a suspicious call claiming to be from SBI? Do not share any OTP, PIN or password. End the call and phone the bank back using the number on your card, passbook or the official website. If you shared information or lost money, report it immediately to your bank and to the cyber crime helpline 1930.

8. Does SBI have to inform customers about a data breach? That is currently debated. The Internet Freedom Foundation says the reporting duties now in force under CERT-In’s directions and RBI’s framework are owed to regulators, and that no law in force clearly requires banks to notify customers. It has called for a customer notification rule. SBI says it will take measures in line with regulatory requirements.

9. Should I change my passwords and PINs? The reported data does not include passwords or PINs, so a change is not clearly required. But changing your net banking password and using a strong, unique one is good hygiene at any time, and it is a low-cost precaution if it makes you feel safer.

10. How can I report fraud or a suspected misuse of my data? Call your bank to block cards or accounts if needed, report on the national cyber crime helpline 1930 or at cybercrime.gov.in, and keep records such as call logs, messages and screenshots. Reporting quickly improves the chances of stopping or recovering a fraudulent transaction.

Disclaimer

This article is for general information and education only. It is not legal, financial or cybersecurity advice. The incident is under investigation and details may change, so rely on official communication from SBI, CERT-In and the Reserve Bank of India for the latest position. Figures and claims reported here come from public reporting as of 21 October 2026.

Sources Consulted

SBI disclosure to BSE and NSE under Regulation 30 of the SEBI LODR Regulations, 21 October 2026, as reported by Times of India and other outlets. Cyber Security News report on SBI’s confirmation (cybersecuritynews.com). The Hans India report on the leak (thehansindia.com). Pragativadi report (pragativadi.com). Sunday Guardian report on the claims and customer steps (sundayguardianlive.com). Hello Banker report on the Siriusim claim (hellobanker.in). Internet Freedom Foundation statement dated 21 October 2026.