UPDATE — 14 November 2026, 6:15 AM IST: The CBD-Belapur police in Navi Mumbai registered an FIR on 12 November 2026 on a complaint by SBI, turning the breach into a criminal case. The case is against unidentified persons under Sections 303(2) and 69(2) of the Bharatiya Nyaya Sanhita and Sections 43(a), 43(b), 43(c), 66 and 66(C) of the Information Technology Act. Police say the attackers first accessed SBI's Global IT Centre servers on 9 October and kept extracting data until 15 October; the breach was detected on 16 October. About 32 CSV files holding roughly 3.75 lakh records and 2,721 PDF files were taken. SBI has told police the stolen data was removed from the dark web and had not been misused. The investigation is ongoing; no one has been named or arrested yet.
Update — 4 November 2026: SBI chairman C.S. Setty said at the bank's second-quarter results press meet on 3 November 2026 that affected customers have been informed about the incident, the root-cause analysis is still under way, and the bank has completed an API sweep and vulnerability assessments as part of containment. SBI and the Indian Banks' Association are also working on a structured mechanism for sharing cyber-threat information between banks. Sources: The Hindu BusinessLine, Zee Business, The Economic Times (all 3 November 2026).
Image: Unsplash / Leo_Visions (free license)
📌 KEY HIGHLIGHTS
- SBI confirmed the exposure in a stock-exchange (SEBI) filing on 21 October 2026 — this is the bank's own disclosure, not a rumour.
- 3,897 customer records confirmed with personal data; the full dump claims about 3.75 lakh records — the rest is NOT yet verified.
- Exposed details include names, registered mobile numbers, dates of birth, email and residential addresses, and branch/CIF identifiers.
- SBI says core operations, funds and transactions are running normally and an independent CERT-In-empanelled agency is investigating.
- A group calling itself "Siriusim" claimed the leak on BreachForums; how the data got out is still unknown.
What happened — the SBI data leak timeline
| Date | What happened |
|---|---|
| 16 Oct 2026 | SBI is alerted by its threat-intelligence provider, the Defence Cyber Agency and CERT-In that suspected SBI customer data is on the dark web. The leak claim also surfaces publicly the same day. |
| 16–21 Oct 2026 | SBI analyses the dump of about 3.75 lakh records and identifies 3,897 customer records containing personal information (PII). |
| 21 Oct 2026 | SBI discloses the incident to the stock exchanges under SEBI rules, activates incident-response protocols, and hires an independent CERT-In-empanelled cybersecurity agency to find the source and full extent. |
| 12 Nov 2026 | CBD-Belapur police (Navi Mumbai) register an FIR on SBI's complaint against unidentified persons under BNS and IT Act sections; SBI says the stolen data was removed from the dark web and not misused. |
The important precision: this is a confirmed customer-data exposure, not a hack of SBI's core banking systems, and no stolen money has been reported. SBI has told investors there is no material impact on its operations or financial performance.
Image: Unsplash / Tarik Haiga (free license)
What data was exposed — and what is only claimed
Confirmed by SBI (3,897 records): names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata linked to loan/lead records.
Claimed by the attacker, not fully verified: the group "Siriusim" says it released the full ~3.75 lakh rows plus 2,722 PDF documents, reportedly loan applications and account-opening forms. Sample records checked by journalists had real phone numbers and looked loan-related — but only the 3,897 matched records are bank-confirmed so far. Treat any bigger number you see on social media as unproven until SBI or investigators confirm it.
What SBI customers should do now
The leaked fields are exactly what a fraudster needs to sound convincing on a call — your name, your branch, even your CIF. So the practical risk is not someone logging into your account (that still needs your credentials and OTP); it is a very believable phishing call or message.
- Never share an OTP, PIN, CVV or password — SBI never asks for them on calls, SMS, WhatsApp or email, whoever claims to be calling.
- Treat "bank verification" calls as hostile by default. Hang up and call SBI's official number yourself if you think there is a real issue.
- Watch your account — check recent transactions in the official YONO app or net banking, and turn on transaction alerts if they are off.
- Be extra careful with loan-related messages — much of the leaked data appears loan/lead-related, so fake "loan officer" calls are the likeliest scam format.
- Do not click links in messages claiming to be about this breach or asking you to "secure your account".
Should you care?
✅ Yes — if you are an SBI customer, care about the phishing risk, not about your balance. SBI says funds and transactions are unaffected, and nothing in the confirmed data (no passwords, no card numbers announced) lets anyone empty an account by itself. ⏳ What is still missing: how the data got out, whether the 3,897 affected customers will be individually informed — the Internet Freedom Foundation has criticised SBI for disclosing to investors first — and what the investigation finds. We will update this post when those answers arrive.
FAQs
Is my money safe in SBI after this data leak?
According to SBI, yes — core banking, funds and transactions are unaffected, and no money loss has been reported. The confirmed exposure is personal information, not account credentials.
What SBI customer data was leaked on the dark web?
For the 3,897 confirmed records: names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, and branch/CIF identifiers, plus loan/lead-related metadata.
How do I know if my data was part of the SBI leak?
SBI has not yet publicly confirmed whether the affected customers were individually informed. Until then, assume any caller who knows your details could be using leaked data — verify everything through official SBI channels only.
What should I do if I get a suspicious call claiming to be from SBI?
Hang up. Do not share any OTP, PIN or code, and do not install any app they suggest. Call SBI's official customer-care number yourself, and report the number as fraud.
TAKEAWAY
The SBI customer data leak on the dark web is real and bank-confirmed for 3,897 records — but it is an information exposure, not stolen money. Stay calm about your balance, and stay sharp about every call and message that uses your personal details.
The same "we know your details" phishing playbook is behind this week's quest diagnostics data breach quanum lsm in the US, where attackers accessed patient records.
Sources: The Hindu — SBI investigates exposure of customer records on dark web (21 Oct 2026) • Hindu BusinessLine — SBI reports suspected exposure of customer data • Economic Times (Reuters) — SBI probes suspected data breach • YourStory — 3,897 SBI customer records in dark-web leak claim< • Free Press Journal — Navi Mumbai cyberattack exposes alleged data theft of 3.75 lakh bank customers (13 Nov 2026) • Newsband — Cyber security breach SBI (13 Nov 2026) • Urban Acres — SBI data breach exposes 3.75 lakh records in Navi Mumbai (13 Nov 2026). Updated 14 Nov 2026 with the FIR details; facts checked 22 Oct 2026.
Comments
Post a Comment