SBI data leak: what is confirmed, what is not, and what you should do now

What happened, in plain words

On 16 October 2026, State Bank of India (SBI) says it was alerted by three sources: its threat-intelligence provider, the Defence Cyber Agency and CERT-In, India's national cyber emergency team. The alert said that bank-related customer data was being shared on the dark web, a hidden part of the internet where stolen data is traded.

Around the same time, an online user with an alias claimed to have posted about 3.75 lakh (375,000) rows of data and 2,722 PDF documents linked to SBI. When this was first reported, the claim had not been verified.

On 21 October, SBI filed a disclosure with the stock exchanges. It said that in a first check of the roughly 3.75 lakh records, 3,897 contained customers' personal information. That is a little over 1% of what was checked.

Timeline

• 16 October: SBI receives the alerts. A monitoring account on X flags the online claim.
• 19 October: A news outlet reports that SBI has not yet commented.
• 20 October: More media coverage, still describing the claim as unverified.
• 21 October: SBI files its disclosure to the exchanges, titled "Incident involving Data Loss".
• 21-22 October: SBI posts "Important Information for Customers" on X, saying balances are safe and that only a very small number of customers are affected.

What SBI has said

• It switched on its cyber-incident response and containment procedures.
• It hired an independent cyber-security firm approved by CERT-In to examine the claim.
• It has not yet confirmed whether the data is genuine and complete, where it came from, or how far it has spread.
• It says there is no material impact on its core business, finances or IT systems. This is about the bank as a business, not about individual customers.
• It says customer balances are "completely safe".

Reported, but not confirmed

• The online claim describes loan applications, account-opening forms and addresses. These details come from the claim, not from SBI.
• It is not known whether the data came from SBI itself, a subsidiary, or an outside company that handles loan enquiries.
• SBI's disclosure does not mention the 2,722 PDF documents. Forms like these can contain copies of ID, so the number of people affected could be larger than 3,897. This is a concern raised by a digital-rights group, not an established fact.
• "3.75 lakh records" does not mean 3.75 lakh people, because records can repeat.

What information may be exposed

The details reported as found in the 3,897 records are:

• names and gender
• registered mobile numbers and email addresses
• dates of birth and home addresses
• branch details and the bank's internal customer file number (called a CIF number)
• lead IDs and loan-related details

Not listed in the disclosure, as reported: account numbers, balances, passwords, OTPs, card details, PAN or Aadhaar. "Not listed" is not the same as "confirmed absent". SBI says its review is still going on.

Why leaked details can still hurt you

This kind of leak does not mean your account has been hacked. The danger is a caller who sounds real. Someone who knows your name, birth date, branch and loan details can say, "This is SBI. Your loan file needs verification." Because the details are correct, people lower their guard and share an OTP, or install an app that takes over the phone. That is how money is lost, not through the leak itself.

"Am I affected?"

• As far as published reports show, SBI has not announced a way to check, and no notice to the 3,897 customers has been reported yet. The Internet Freedom Foundation and an opposition MP have criticised this.
• Wait for a message from SBI through its official channels, and check it as described below.
• Do not click any link, QR code or WhatsApp message that says "check if your SBI data leaked". Expect scammers to send exactly these.

What to do now

1. Never share your OTP, PIN, CVV, net-banking password or UPI PIN with anyone. SBI says it never asks for them by phone, SMS or email.
2. Do not click links in messages about KYC updates, loans or "refunds". Type sbi.bank.in yourself or use the official SBI app.
3. Hang up and call back on the number printed on your passbook, card or the SBI website, if a caller says they are from the bank.
4. Check your statements, switch on SMS and app alerts, and set transaction limits on your cards.
5. Keep a different UPI PIN from your ATM PIN, and keep your phone locked.
6. Be careful with surprise loan offers or callers who quote your loan details.
7. Warn your family, especially senior citizens.

If someone calls or messages you

• Say nothing about your account and end the call.
• Report the number on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the Sanchar Saathi portal for suspicious calls.
• Forward suspicious messages that claim to be from SBI to the email addresses listed at the end of this article.

If money has been taken

1. Call 1930 immediately. The first hour gives the best chance of freezing the money.
2. Tell your bank right away. For SBI, use the number for unauthorised transactions listed below.
3. File a complaint at cybercrime.gov.in and keep screenshots, call logs and transaction IDs.

Your rights. The RBI circular of 6 July 2017 on limiting customer liability says:

• If the fault lies with the bank, you pay nothing.
• If the fraud happens outside the bank and outside your control, you have zero liability if you report within three working days of receiving the bank's message about the transaction.
• If you report in four to seven working days, your liability is limited, with caps of ₹5,000, ₹10,000 or ₹25,000 depending on the type of account.
• The bank should credit the disputed amount within 10 working days of your report, and the bank has to prove that you were at fault.
• If the loss happened because you yourself shared a credential such as an OTP, the treatment is different. Report quickly anyway.

Rules can change. Check rbi.org.in for the current text.

The questions being asked

• Telling customers. SBI informed investors, but in reports so far it has not announced that it is notifying customers. The Internet Freedom Foundation says an RBI advisory of March 2026 recommends telling affected customers, and describes it as not binding.
• The law. The duty under the Digital Personal Data Protection Act to inform affected people is expected to apply from May 2027, according to the same group.
• The cause. SBI has not explained how the data left the bank.

These are questions raised by others, and we have not tested them ourselves. We will update this article if SBI or the regulator answers.

Words explained

• Dark web: hidden websites where stolen data is sold or shared.
• Data leak or breach: private information reaching people who should not have it.
• CIF number: the bank's internal customer number.
• CERT-In: India's national cyber emergency response team.
• Impersonation fraud: a scammer pretending to be your bank or an official.

Quick answers

Is my money safe?

SBI says balances are completely safe. Nothing reported so far shows money being taken because of this leak.

Should I close my account?

No. Stay alert and follow the steps above.

Should I change my password?

Passwords are not listed as exposed. Changing one is harmless good habit, but never do it from a link in a message.

Is this a hack of SBI?

Not confirmed. SBI says it is still working out the source.

Official contacts

• Cybercrime helpline: 1930 and cybercrime.gov.in
• SBI, unauthorised transactions (toll-free): 1800 11 1109 or 94491 12211
• SBI, report phishing: report.phishing@sbi.co.in
• SBI, suspicious calls, SMS or emails that claim to be from SBI: epg.cms@sbi.co.in

Last updated 22 October 2026. This is general awareness, not legal advice. The situation is still developing.