SBI confirms data breach, says 3.75 lakh records exposed on dark web The State Bank of India (SBI) has confirmed a data loss incident involving the suspected exposure of customer information on the dark web, reporting that a preliminary assessment identified approximately 3.75 lakh records, including 3,897 customer records containing personally identifiable information. In a letter dated October 21, 2026, to the BSE and the National Stock Exchange, SBI said it received alerts on October 16 from its Threat Intelligence Service Provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about the suspected exposure of customer data on the dark web. The bank said the preliminary analysis identified approximately 375,000 records. Of these, 3,897 customer records contained personally identifiable information (PII). What information has been compromised? The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer identification details, lead IDs and metadata associated with loan and lead records, along with other related files. SBI initiates investigation into customer data exposure SBI said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the risks to customers and the bank. The bank said it activated its cyber incident response and containment protocols after receiving the alerts. It also engaged an independent cybersecurity agency empanelled by CERT-In to assess and investigate the nature and extent of the suspected compromise. Bank says core operations remain unaffected SBI said the incident had no material impact on its core business operations, financial performance or business continuity. The bank added that its core functions continued to operate normally without disruption. A detailed assessment was under way, and remedial and preventive measures were being implemented as required. SBI said it would continue to monitor the situation and take appropriate measures in accordance with regulatory requirements. The disclosure was made under Regulation 30 of the Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015. #SBIdatabreach #India #CyberSecurity