SBI Discloses Customer Data Leak on Dark Web, Identifies 3,897 Records Containing Personally Identifiable Information:

The State Bank of India (SBI), vide an intimation dated October 21, 2026, has disclosed to the stock exchanges an incident in which certain customer data was leaked.

The bank informs that on October 16, 2026, it had received certain communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In concerning the exposure of the bank's customer data on the dark web. Subsequently, the bank initiated analysis of about 375,000 records available on the dark web. During the preliminary analysis, the bank discovered 3,897 customer records containing Personally Identifiable Information (PII).

According to the sources, the customers' leaked information includes their registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files.

The bank succeeded in timely activating its cyber incident response and containment protocols. Further, to conduct a thorough investigation and analysis of the present incident, the bank also engaged an independent CERT-In-empanelled cybersecurity agency.

Presently, the bank is hoping for no material impact on its core business operations, financial performance or business continuity as a consequence of the incident. The bank is not facing any difficulties/disruptions in operating its core business functions normally.

The bank has assured all its customers that it is closely monitoring the situation and will adopt all possible measures to protect its customers' information.

The SBI has made the aforementioned disclosure to the National Stock Exchange of India Limited (NSE) and Bombay Stock Exchange Limited (BSE) under Regulation 30 of the Securities and Exchange Board of India (LODR) Regulations, 2015.