In October 2026, the State Bank of India (SBI) received alarming alerts from multiple sources about a potential data breach. The bank's Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In all flagged suspected exposure of customer data earlier in the week. These warnings set in motion a chain of events that would reveal one of the most significant cybersecurity incidents in India's banking sector.
On October 21, SBI made an official disclosure to stock exchanges confirming what had been suspected: customer data had been leaked on the dark web. The bank's preliminary analysis identified 3,897 customer records containing personally identifiable information (PII) among the 3.75 lakh (375,000) records that had been compromised. This initial investigation involved examining 2,722 PDF documents and numerous CSV files that had made their way to the dark web.
State Bank of India reported a cyberattack that resulted in the disclosure of 3,897 customer records containing personally identifiable information on the dark web https://t.co/qKC4nOPB1S
The leaked data contained a treasure trove of sensitive customer information, including mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch details, CIF numbers, and loan-related records. This combination of personal and financial details created significant risks for affected customers, potentially enabling identity theft, financial fraud, targeted phishing attacks, and fraudulent loan applications.
The bank appointed an independent cybersecurity agency to conduct a comprehensive assessment and investigate the nature and extent of the data leak.
According to cybersecurity firm CyberPulse, the attack was carried out by a group identified as Siriusim. The breach was first reported on October 16, when the initial warnings reached SBI. CyberPulse has warned of potential risks such as identity theft and financial fraud associated with the exposed data.
Today’s Raavan wears many disguises to deceive you. Don’t fall for the act! This Dussehra, join Captain Y in unmasking cyber fraudsters. Stay alert and before trusting any unknown message, link or call, Hamesha Poochho Why? SBI wishes everyone a Shubh aur CyberSafe Dussehra! @DFS_India @DARPG_GoI @Cyberdost
Upon confirming the breach, SBI took immediate action to address the situation. The bank appointed an independent cybersecurity agency to conduct a comprehensive assessment and investigate the nature and extent of the data leak. This external investigation aims to determine the source, authenticity, and full scope of the data exposure. Additionally, SBI implemented enhanced security protocols to mitigate potential damage and prevent similar incidents in the future.
Despite the significant data breach, SBI has assured customers and stakeholders that the incident does not impact the bank's core business operations, financial performance, or business continuity. The bank clarified that all banking operations and customer accounts remain secure, and financial transactions continue to process normally. This assurance comes at a critical time when customer trust in digital banking is increasingly important.
#WATCH | SBI data breach | Chandigarh: Chairman of the International Commission on Cyber Security Law, Pawan Duggal, says, "The SBI data leak is no ordinary incident. India is the world’s most populous nation. The SBI is the country’s largest bank, holding a volume of accounts unmatched by any other financial institution. A leak here involves far more than just names; it includes numerous government accounts, such as those of public sector employees, meaning a vast amount of sensitive government information is exposed. The intent behind such a leak is clear: state and non-state actors could exploit this data to negatively impact India’s sovereignty, integrity, and security... Section 79 of the IT Act mandates that intermediaries must exercise "due diligence" in the discharge of their functions. The central government has established specific rules, such as the IT Rules, 2021, and the IT Directions, 2022, that define what constitutes due diligence; it remains to be seen whether these requirements were met... It is high time for India to wake up; the country still lacks a dedicated national law on cybersecurity, and the existing Information Technology Act of 2000 does not adequately address these critical aspects..."
The Reserve Bank of India (RBI) has acknowledged the cyber attack on SBI's website and advised all banks to enhance their cybersecurity measures to prevent similar attacks in the future. The incident highlights the ongoing challenges in cybersecurity for financial institutions in India, particularly amid heightened regulatory focus on data protection. SBI has also informed SEBI (Securities and Exchange Board of India) about the incident, demonstrating the regulatory oversight that accompanies such breaches.
As of late October 2026, SBI continues its investigation into the data breach while implementing remedial and preventive measures. While the potential risks of identity theft and financial fraud have been identified, SBI has assured customers that the incident does not impact core banking operations or financial performance. The incident serves as a stark reminder of the persistent threats facing financial institutions in an increasingly digital world, and the critical importance of robust cybersecurity measures to protect sensitive customer information.