State Bank of India (SBI) has disclosed a data loss incident after a preliminary review identified 3,897 customer records containing personal information on the dark web. The bank reported the findings in an October 21, 2026, stock exchange filing, while saying investigators still needed to establish the data’s authenticity, completeness, and source.

The disclosure confirms an incident involving data loss, but does not establish how the information was obtained or whether attackers breached SBI’s core banking systems. The bank said its services continued to operate normally, with no material impact on core operations, financial performance, or business continuity.

SBI Confirms Data Breach

SBI said it received alerts on October 16 from its threat intelligence service provider, the Defense Cyber Agency, and the Indian Computer Emergency Response Team, known as CERT-In. These communications concerned suspected exposure of customer information on the dark web.

Investigators reviewed approximately 375,000 records and identified 3,897 customer records containing personally identifiable information, or PII. The larger dataset should not be described as 375,000 confirmed victims. Record counts can include repeated entries and do not necessarily represent separate people.

The information reportedly included registered mobile numbers, dates of birth, names, gender, email addresses, and residential addresses. SBI also listed branch and customer information file identifiers, lead IDs, and metadata linked to loan records, lead records, and related files.

These fields go beyond a contact list. Branch details and loan references could help fraudsters make fake banking calls sound credible. However, the filing does not list passwords, PINs or one-time passwords among the exposed information, and it does not report stolen funds.

Cyber Security News previously covered the SBI data breach claim involving an actor using the name Siriusim. That report described claims involving 375,000 CSV rows and 2,722 PDF files. Those allegations remain separate from the findings SBI has now disclosed, which do not attribute the incident to a named attacker.

SBI quickly activated its procedures to respond to and contain the cyber incident. It also hired an independent cybersecurity agency approved by CERT-In to evaluate the situation and investigate the extent of the suspected breach.

The investigation will examine the data’s authenticity and completeness, identify its potential source, determine the scale of exposure and assess risks to customers and the bank. SBI said remedial and preventive measures were being implemented as required.

The filing does not identify an entry point, exploited vulnerability, malware family or compromised server. It therefore provides no basis for attributing the incident to ransomware, phishing or a specific software flaw.

A separate Bank of Baroda data breach report covered unauthorized access to an employee email account. That case offers banking security context, but does not establish any connection or shared attack method with SBI’s incident.

For customers, targeted phishing is a potential concern rather than a confirmed consequence. CERT-In’s online scam advisory warns that criminals use fake bank messages, urgent account warnings, and requests for personal information to deceive users.

Customers should verify unexpected messages through official banking channels, avoid unfamiliar links and never share PINs or one-time passwords. They should check statements for unauthorized transactions. SBI said it would continue monitoring the situation and take appropriate measures under applicable regulatory requirements. Further findings are needed before the incident’s source and full impact can be established.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post SBI Confirms Data Breach – 3000+ Customer Records Exposed on Dark Web appeared first on Cyber Security News.