New Delhi, October 24, 2026: With concerns over the safety of personal information growing after a suspected data exposure, the State Bank of India (SBI) has urged customers to remain alert to potential online banking fraud. The lender has confirmed that customers whose information was identified in the incident have been individually notified, while reiterating that their account balances and funds remain safe.
The bank issued the update on Friday, October 23, following the discovery of personal information in records found on the dark web. SBI said it had contacted the affected customers through email and/or WhatsApp and advised them to exercise caution when dealing with unfamiliar calls, messages and emails.
The incident came to the bank’s attention on October 16, when alerts were received from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). According to SBI’s preliminary assessment, around 375,000 records available on the dark web were examined, with 3,897 records identified as containing personally identifiable information.
The data reportedly included names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. Some records also contained branch details, Customer Information File (CIF) identifiers, lead IDs and information associated with loan and lead records.
Following the alerts, SBI activated its cyber incident response and containment procedures. The bank also appointed an independent cybersecurity agency empanelled by CERT-In to investigate the incident, determine the possible source and extent of the exposure, verify the affected information and assess the potential risks.
SBI has stated that the incident has not had a material impact on its core business operations, financial performance or business continuity. Its core banking services continue to operate normally, according to the bank.
As the investigation continues, customers have been advised not to disclose one-time passwords (OTPs), PINs or banking passwords to anyone. They should also be cautious of unsolicited communications requesting personal or financial information, particularly messages or calls claiming to be from bank officials.
The investigation is expected to provide further clarity on the nature and extent of the suspected data exposure. In the meantime, SBI’s latest communication seeks to reassure customers about the safety of their funds while encouraging greater vigilance in digital banking.
