New Delhi: State Bank of India on Friday (October 23, 2026) said that it had individually informed all customers whose data were identified as being involved in the recent data breach, through email and/or WhatsApp, seeking to address criticism that it had disclosed the incident to stock exchanges without alerting those affected.
Funds Safe, Bank Assures
In a statement, the SBI said: “We reiterate that your account balances and funds are safe with us.”
“Customers are advised to follow safe digital banking practices, never share their OTP, PIN or password with anyone, and remain vigilant against suspicious calls, messages and emails,” it stated.
Criticism Over Disclosure
The country’s largest public sector bank had come under criticism for not informing affected customers even though it intimated the incident to stock exchanges. The clarification on Friday appears to be an attempt to close that gap and reassure customers.
What Was Exposed
Earlier in the month, the SBI said it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In regarding an alert concerning the suspected exposure of its customer data on the dark web. On Wednesday, October 21, 2026, the bank informed stock exchanges about the incident involving the loss of certain data.
“During the preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified,” SBI told the exchanges as per SEBI disclosure norms.
The exposed information included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files, it stated.
Investigation Underway
The bank said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.
Notably, the preliminary analysis found that just 3,897 of the roughly 3,75,000 records available on the dark web contained genuine customer PII — suggesting a large portion of the advertised data may not be authentic or may not relate to the bank’s customers.
What Customers Should Do
SBI’s advisory to customers centres on basic digital hygiene: never share OTPs, PINs or passwords; remain alert to suspicious calls, messages and emails; and follow safe digital banking practices. Customers who receive communication from the bank about the breach should verify it through official SBI channels before responding.
