State Bank of India Investigating Reported Dark Web Leak of Customer Records

In the filing, SBI said it was contacted in mid-October by its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In in response to an alert about data leaking onto the dark web. SBI is India's largest public-sector bank and one of the country's biggest financial institutions, with the Indian government as its majority owner. It provides personal and business banking, loans, credit cards and related services.

According to the filing, 375,000 records were apparently made available on the dark web, among them 3,897 bank customer records containing personally identifiable information. The exposed information reportedly included customers' registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan and lead records and other related files.

The bank said it does not yet know whether the leak is authentic, who was responsible, or how the data was obtained. It has begun a detailed investigation to determine the source and extent of the exposure and to assess any associated risks, triggered cyber incident response and containment protocols, and brought in an independent CERT-In-empanelled cybersecurity agency for forensic analysis. SBI said the leak does not have a material impact on its business operations and that it expects to continue functioning as usual.

TechRadar reported that an X account called CyberPulse56 flagged a dark web forum post published on October 16, 2026 by a threat actor using the name Siriusim, who claimed to hold 375,000 CSV rows and 2,722 PDF documents belonging to the bank. The post allegedly contained personal customer information, loan applications and supporting documents, account-opening applications, and address and other application-related details. The Free Press Journal later established that the post appeared on BreachForums and concluded that at least some of the data was authentic, finding that a WhatsApp profile picture associated with one phone number matched the passport-size photograph on that person's KYC document, and that the shared sample related mainly to loans and contained KYC fields.

TechRadar reported that there was no information connecting the data to SBI, any of its subsidiaries or third-party providers in its supply chain, so it could not be concluded whether the bank was actually breached. The data could have originated in an older breach, from an entirely different entity, or from a recycling of multiple older breaches, the outlet reported.

If the data is confirmed as authentic, the information involved, including postal addresses, CIF identifiers and loan records, could be used to build convincing phishing messages that persuade victims to download malware or hand over login credentials, TechRadar reported. Such a second-stage compromise could in turn lead to ransomware or business email compromise attacks. The outlet advised SBI customers to be wary of incoming email claiming to come from the bank, particularly messages carrying a sense of urgency or threatening account closure or loss of funds.