Breach · · 3 min read
SBI says 3,897 customer records were in a dark-web set
On October 21 the bank told the stock exchanges that a first pass over about 375,000 records found 3,897 with customer details. It is still checking them.
State Bank of India told the Bombay Stock Exchange and the National Stock Exchange on October 21, 2026 that it has had an incident involving the loss of certain data. The filing is a notice to the exchanges under SEBI's listing rules. It is not a letter to customers, and it does not say the bank has finished proving where the data came from.
What the filing says was found
On October 16 the bank heard from its threat-intelligence provider, the Defence Cyber Agency, and CERT-In. The alert was about suspected exposure of customer data on the dark web.
A first look at about 375,000 records found there identified 3,897 customer records that contain personal information. The filing says the exposed information reportedly included:
- registered mobile numbers
- dates of birth
- names
- gender
- email addresses
- residential addresses
- branch identifiers and Customer Information File identifiers
- lead IDs
- metadata tied to loan and lead records, and other related files
"Reportedly" is the bank's word. The same filing says a closer investigation still has to establish whether that data is authentic and complete, where it came from, how far it goes, and what risk it poses to customers and to the bank.
The other records in the set of about 375,000 are not described. The filing does not say they are SBI customers.
What the bank says it has done
SBI says it turned on its cyber incident response and containment. It hired an outside cybersecurity firm that is empanelled by CERT-In to assess the alleged compromise.
It says this does not have a material effect on core operations, financial results, or keeping the business running, and that core functions are operating as usual. It does not describe how the data left, and it does not say that affected customers have been notified.
What to do
- Treat the 3,897 figure as the bank's first cut, not a finished list. SBI is still checking authenticity. A number in an exchange filing can move once that check is done.
- Do not answer a call or a text that already knows a loan detail. A mobile number, a date of birth, and a branch identifier are enough to sound like the bank. SBI's filing does not ask you to confirm a password, a one-time code, or a card number with someone who contacted you first.
- This filing is not itself the notice that you were included. It does not name customers. If SBI writes to you, that letter is the one that says you were in the 3,897. Until then, the exchange notice is a warning about a set of records, not a statement that every SBI account was copied.
- A password you never stored with the bank is a different problem. The filing lists contact details and loan-record metadata. It does not list internet-banking passwords or card numbers.
How Frame helps
Frame keeps a catalog of known breaches and lets you add ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups are not live yet. Frame does not collect or store the leaked records.
Sources
- State Bank of India, Disclosure under Regulation 30 of SEBI (LODR) Regulations, 2015 — Incident involving Data Loss, October 21, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.