State Bank of India reports cyber attack: Thousands of customer records affected, here’s what we know
follow us
Add us as a preferred source on Google
- State Bank of India investigating alleged dark web data breach affecting thousands of customer records
- The exposed information allegedly includes personal data, loan-related data and customer identifiers.
- The bank has launched a forensic investigation but has not yet confirmed the source or authenticity of the leak.
The State Bank of India (SBI) confirmed the loss of sensitive data of thousands of its users and, worryingly, said it still does not know when or where the leak took place.
SBI is India’s largest public sector bank and one of the largest financial institutions in the country. It is majority owned by the Indian government and offers services such as personal and commercial banking, loans, credit cards and the like.
The company filed a new report with the country’s stock exchange, stating that it experienced “an incident related to the loss of certain data.” In the filing, it said that in mid-October 2026 it was contacted by its threat intelligence services provider, the Defense Cyber Agency and CERT-In, in response to an alert about a data breach on the dark web.
Latest videos ofTechnologyRadar
Personal information leak
Apparently, 375,000 records were made available on the dark web, among which were 3,897 bank customer records containing personally identifiable information (PII).
“The exposed information allegedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and metadata associated with loan/lead records and other related files,” the document said.
So far, the bank does not know if the leak is authentic, who leaked it or how they obtained the data. Initiated a detailed investigation to determine the source and extent of the exposure and evaluate the associated risks. Cyber incident containment and response protocols were activated, and an independent cybersecurity agency comprised of CERT was hired to conduct forensic analysis.
The bank stressed that the leak does not have a material impact on its business operations and that it expects to continue operating normally.
Meanwhile, an X account called CyberPulse56 flagged a post on a dark web forum, made on October 16, 2026 by a threat actor called Siriusim. In the post, the actor claimed to have 375,000 CSV rows and 2,722 PDF documents belonging to the bank. They allegedly contained personal customer information, loan applications and supporting documents, account opening requests and addresses, and other details related to the applications.
The Free Press Journal later established that the post was made on BreachForums, one of the dark web’s most popular cybercrime forums, and concluded that at least some of the data found there was authentic. It found that a WhatsApp profile image associated with a number matched the passport-sized photograph on that person’s KYC document, and also found that the shared sample was mainly related to loans and contained KYC fields.
There is no clear connection with SBI
However, there was no information connecting the data to SBI, any of its subsidiaries or third-party suppliers in its supply chain. Therefore, we cannot conclude whether the SBI was actually violated or not. There are several ways this data could have ended up on the dark web: it could originate from a previous breach, it could be from a completely different entity, or it could be a recycling of several previous breaches, something cybercriminals are known to do.
However, if the data is confirmed to be authentic, it could pose a significant risk to the bank’s customers. Information such as postal addresses, CIF identifiers and loan records can be used to create very convincing phishing emails, through which victims could end up downloading malware or sharing vital login credentials with attackers.
This type of stage two compromise can lead to ransomware or BEC attacks, which could cause serious disruptions, trigger class action lawsuits, and lead to brand erosion. SBI users should be wary of incoming emails, especially those claiming to be from the bank, that convey a sense of urgency or threaten account closure or movement of funds.
Through Hacker News
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment