SBI's dark web leak: what is confirmed, and what is only claimed

The short version

• Confirmed by SBI: 3,897 customer records containing personal information were found in a set of about 3.75 lakh records on the dark web.
• Exposed, per SBI: names, mobile numbers, dates of birth, gender, email and home addresses, branch and customer (CIF) numbers, and loan-lead details.
• Not listed by SBI: account numbers, balances, passwords, OTPs, card details, PAN or Aadhaar.
• Not known yet: where the data came from, whether the rest of the dataset is genuine, and whether affected customers will be told.
• The main risk now: scam calls and messages that sound convincing because the caller already knows your details.

Claimed versus confirmed

Two very different numbers are going around. The larger one comes from the seller. The smaller one comes from the bank.

A row in a spreadsheet is not a person. Neither SBI nor the seller has said how many different people the data covers, and SBI has not said whether the 3,897 records belong to 3,897 separate customers.

How it unfolded

1. 16 Oct
   The claim surfaces. A threat-monitoring account on X flags the BreachForums post. The same day, SBI receives alerts about a “suspected exposure of the Bank’s customer data on the dark web” from its threat intelligence provider, the Defence Cyber Agency and CERT-In, India’s national cyber agency.
2. 19 Oct
   It becomes news. India Today reports the claim. SBI has not commented, and India Today says it could not confirm the breach.
3. 21 Oct, 8:51 am IST
   SBI tells investors. The bank files a disclosure with the National Stock Exchange and BSE, titled “Incident involving Data Loss”, confirming the 3,897 records and the types of data exposed.
4. Now
   Investigation under way. An independent firm from CERT-In’s panel of approved auditors is assessing “the nature and extent of the alleged compromise”. No cause has been named.

What a scammer could now know about you

If your record is in the confirmed set, this is the kind of profile the leaked fields add up to. None of it can move money by itself. All of it can make a fake call from “your bank” sound real.

What the rules required, and what they don’t

Indian rules give organisations hours, not days, to tell regulators about a cyber incident. The general duty to tell the people whose data leaked, under India’s data protection law, is not in force yet.

This is why SBI’s filing is addressed to investors, not customers. It does not say whether the customers behind the 3,897 records have been or will be contacted. The Internet Freedom Foundation has asked SBI to inform every affected customer directly, and asked the RBI to require banks to do so. See every deadline on the timeline in the four clocks.

Read the filing like an analyst

Same words, three months apart

SBI is not the first Indian bank to make this kind of filing this year. On 27 July 2026, Bank of Baroda disclosed a cyber incident after an anonymous source claimed access to its data. Its preliminary finding was a “potential business email compromise”. The two filings use almost the same language.

Similar wording is normal in regulatory filings and is not a sign of anything wrong. It does show how little these filings tell the public: the important parts, the cause and what it means for customers, come later, if at all.

The bigger picture

Sources and method for these figures: Confirmed? on the Ransomware in India page, and the CERT-In counts on the four clocks.

What we don’t know yet

• Where the data came from: SBI’s own systems, a subsidiary or a service provider.
• Whether the rest of the 3.75 lakh records, and the 2,722 PDFs, are genuine SBI data.
• How many different people are affected.
• Whether Aadhaar numbers or KYC documents are included. Early reports of the claim mentioned them; SBI’s list does not.
• Whether and how affected customers will be told.

This story sticks to what SBI and named sources have said. It will be updated when the investigation reports or SBI says more.