Saifu
Saifu
Amazon Great Indian Festival: up to 10% off with Axis Bank and ICICI Bank cards. See which card winsMyntra Big Fashion Festival: HDFC Bank credit cards (not co-branded) take 10% off, up to ₹1,000. See which card winsCroma Festival of Dreams: see which of your cards earns the most on Croma

Learn / What changed

What changed

SBI data leak: what was exposed and what customers should do

SBI says 3,897 customer records with names, mobile numbers and addresses were found on the dark web. What leaked, what did not, and how to stay safe.

By Saifu team · · 3 min read · Reviewed by Chandan Kumar Dash

State Bank of India, the country's largest bank, says some of its customers' personal details have turned up on the dark web, the hidden part of the internet where stolen data is sold. Here is what the bank has said so far and what you can do.

What SBI said

In a filing with the stock exchanges on 21 October 2026, SBI said it received alerts on 16 October 2026 from its threat intelligence service provider, the Defence Cyber Agency and CERT-In, India's national cyber security agency, about the suspected exposure of customer data. This is as reported by The Economic Times, The Times of India and Moneycontrol.

The bank said a first look at about 3,75,000 records on the dark web found 3,897 customer records with personal details. It has started its cyber incident response and hired an independent cyber security firm empanelled by CERT-In to find out whether the data is real, where it came from and how far the exposure goes. SBI said the incident has no material impact on its business, and its services are working normally.

What was in the records

According to the filing, the exposed records reportedly include:

What SBI did not list

Account numbers, account balances, passwords, OTPs, card details, and PAN or Aadhaar numbers are not among the details the filing lists, as The Hacker News noted. A hacker group calling itself Siriusim has claimed it also holds 2,722 PDF documents, including loan applications and account-opening documents, as reported by The Times of India. SBI has not confirmed that claim, and its investigation is still going on. The filing also does not say whether the affected customers will be told.

Why it still matters

Your name, date of birth, address, branch and customer number are exactly what a fraudster needs to sound like a real bank employee. Expect calls, SMS or WhatsApp messages that use these details and then ask you to "update KYC", "approve a loan", "unblock your card" or install an app. The aim is to get an OTP, PIN or remote access to your phone.

What you should do

  1. Never share an OTP, PIN, CVV or password, even with someone who knows your account details. SBI, RBI and the police never ask for them.
  2. Do not install apps from links sent by SMS or WhatsApp, and do not give anyone screen-sharing or remote access to your phone.
  3. Call back on the official number. If a caller says they are from SBI, hang up and call the number on the back of your card or on the SBI website.
  4. Check your credit report for loans or cards you did not apply for. Each credit bureau gives you one free full report a year.
  5. Keep SMS and email alerts on for every transaction, and set limits on your card and UPI in the YONO app if you do not need high limits.
  6. Report phishing messages to SBI at report.phishing@sbi.co.in.
  7. If money is taken, tell the bank at once, call 1930 and file a complaint at cybercrime.gov.in. Reporting within 3 working days matters under RBI's zero liability rule. How the refund rule works.

You do not need to close your account or change banks because of this. Watch out for calls that sound official. Read also how the SBI "jumped deposit" scam works.

Not the same as the HDFC Bank probe

On 21 October 2026 Bloomberg and The Economic Times reported that HDFC Bank is reviewing whether two senior executives passed confidential business information to outsiders. Those reports are about internal business matters, not customer accounts, and HDFC Bank said only that an internal review is under way.

Sources: The Economic Times: SBI flags dark web exposure of 3,897 customer records, 21 October 2026, The Economic Times: SBI investigates dark web leak of 3.8 lakh records, 22 October 2026, The Times of India: SBI data leak, what we know so far, 21 October 2026, Moneycontrol: SBI data leak, nearly 3,900 customer records found on dark web, 21 October 2026, The Hacker News: State Bank of India confirms data leak, 21 October 2026, Mint (Bloomberg): HDFC Bank internal probe, 21 October 2026, The Economic Times: HDFC Bank begins probe into alleged internal data leak, 22 October 2026.

Rules, rates and limits change. Check the official source linked above before you rely on a figure here. Posts never contain referral or affiliate links from the writer.

Want to write for Saifu? Here is how.

Spot a mistake on this page? Tell us