3.75 lakh records, 3,897 customers: SBI says address, mobile numbers, email ID leaked in data breach
The lender said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure.
- Oct 21, 2026,
- Updated Oct 21, 2026 1:37 PM IST
The State Bank of India, in an update on its customer data breach on the dark web said records such as residential addresses, mobile numbers and email addresses were compromised on October 16. In a filing, it said it was informed of the breach by its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In.
“During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files,” it said.
MUST READ | SBI data breach? Hacker claims leak of 3.75 lakh records, over 2,700 documents
The lender said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure as well as assess the associated risks to the customers and the bank.
“The bank promptly activated its cyber incident response and containment protocols. Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise,” it said.
DON'T MISS | EBLR vs RLLR: How SBI's lending rate revision affects home loan borrowers
SBI said the data breach does not have any material impact on its core business operations or financial performance, which continue to operate normally without disruptions. “A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required,” it said, adding that it will monitor the situation closely and take appropriate measures.
The State Bank of India, in an update on its customer data breach on the dark web said records such as residential addresses, mobile numbers and email addresses were compromised on October 16. In a filing, it said it was informed of the breach by its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In.
“During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files,” it said.
MUST READ | SBI data breach? Hacker claims leak of 3.75 lakh records, over 2,700 documents
The lender said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure as well as assess the associated risks to the customers and the bank.
“The bank promptly activated its cyber incident response and containment protocols. Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise,” it said.
DON'T MISS | EBLR vs RLLR: How SBI's lending rate revision affects home loan borrowers
SBI said the data breach does not have any material impact on its core business operations or financial performance, which continue to operate normally without disruptions. “A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required,” it said, adding that it will monitor the situation closely and take appropriate measures.