SBI Dark Web Breach: 3,897 Customer Records Exposed

SBI reviewed roughly 375,000 records circulating on the dark web , a dataset that also included 2,722 PDF documents , and identified 3,897 of those as containing real customer personally identifiable information (PII). The bank has activated its incident response team and hired an independent cybersecurity firm approved by CERT-In to run a full investigation.

How the Alert Reached SBI

On October 16, 2026, SBI received alerts from three sources simultaneously: its own Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In , India’s national cybersecurity body.

That three-source alert is worth noting. It suggests the data had appeared across multiple monitoring feeds before SBI formally learned it. The bank then ran a preliminary sweep of approximately 375,000 records available on the dark web, which amounts to roughly 3.75 lakh records in Indian numbering. Only 3,897 , just above 1% , came back as confirmed customer PII belonging to SBI.

This is the same early-warning dynamic we’ve covered in looking at how dark web signals surface before organizations know they’ve been exposed . Threat intelligence feeds catch these listings as they appear — often before the breached organization has any internal indication anything is wrong.

What Was in the 3,897 Records

According to SBI’s regulatory filing, the confirmed records included:

Registered mobile numbers

Residential addresses

CIF (Customer Information File) numbers , the unique ID the bank uses to link a customer across all their accounts

Lead IDs and metadata linked to loan applications and lead records

SBI specifically said there is no confirmed impact on core banking operations or account balances . The exposed data appears to be from loan application and lead management systems, not from core transaction infrastructure.

That distinction matters. CIF identifiers, loan application details, and addresses are genuinely sensitive. They’re the building blocks of convincing social engineering calls impersonating SBI staff. But they aren’t the same as having access codes, PIN numbers, or account credentials.

This follows the same pattern as the Bank of Baroda data breach covered earlier this year , where KYC records and customer identifiers appeared on the dark web without core banking systems being directly compromised. Indian banks’ customer-facing application systems are increasingly the softer target.

Crafty Falcon: What CERT-In Has and Hasn’t Said

One specific detail in the Reuters and Mint reporting caught attention: CERT-In has not linked this exposure to a campaign known as Crafty Falcon.

Crafty Falcon is an advanced hacking campaign believed to be India-focused, with suspected state-linked involvement. The absence of a confirmed link to that campaign is meaningful. It doesn’t rule out nation-state involvement entirely , it means CERT-In hasn’t established that specific attribution for this incident.

The investigation is still early. SBI said the independent cybersecurity agency it has engaged will determine: whether the data is authentic and complete, what the likely source was, and what risks exist for customers and the bank.

The Q2FY27 Context: A Profitable Bank With a Security Problem

The dark web disclosure comes in the same week that SBI reported strong Q2FY27 earnings. Net profit for the quarter was Rs 23,038 crore , up 14.3% year on year. Net interest income rose 14.7% to Rs 49,143 crore. Provisions dropped 33%.

Chairman CS Setty reiterated the bank’s FY27 guidance of 10–11% deposit growth and 14–15% credit growth, citing a Rs 7.8 lakh crore corporate loan pipeline. He also said SBI sees no near-term need to raise deposit rates.

A healthy balance sheet doesn’t neutralise a cybersecurity incident , but it confirms the bank has the operational stability and resources to manage a thorough investigation without existential pressure to minimise the findings.

India’s Banking Sector AI Cyber Risk Response

This exposure arrives as SBI and the Indian Banks’ Association (IBA) are actively building a coordinated response to AI-driven cyber threats across Indian banking.

The initiative focuses on threat intelligence sharing between banks, joint penetration testing, and faster collective action when large-scale attacks are detected. The concern driving this coordination is that AI is allowing criminals to run attacks at a scale and speed that individual banks’ defences weren’t designed to handle alone.

As we’ve seen in the CRIF Cyber Observatory’s H1 2026 data , which found 2.5 billion records in circulation on the dark web globally in just six months , the volume of compromised data available to criminal actors makes credential and identity attacks structurally easier to run at scale than they were even two years ago.

The IBA coordination programme is partly a response to this arithmetic: individual banks can patch their own systems, but the data that fuels phishing attacks against their customers often originates somewhere else entirely. The ValueFirst dark web alert earlier this year highlighted exactly this dynamic , when a communications platform serving multiple banks appears in threat intelligence feeds, the risk isn’t confined to one institution.

What SBI Customers Should Do Right Now

If you are an SBI customer, the specific risk from this exposure is targeted social engineering. Someone with your name, mobile number, address, and CIF identifier can call you sounding like a genuine SBI representative. They already know account-related details. That credibility is the attack surface.

SBI will never call you to ask for your OTP, PIN, or internet banking password. Any inbound call that references your loan application, branch identifier, or account details and then asks you to confirm sensitive information or click a link is a scam regardless of how much real data the caller already has.

If you receive such a call, hang up and report it to the National Cyber Crime Reporting Portal or call 1930.

Log in directly to your SBI YONO app or online banking at sbi.co.in and check whether any recent activity looks unfamiliar. If you have any concern, SBI’s customer care at 1800 11 2211 or visit your branch.

For a broader guide on what to do when your personal data appears in a dark web exposure, our step-by-step response guide covers the full checklist.

Frequently Asked Questions

How many SBI customer records were exposed on the dark web?

SBI confirmed 3,897 records containing customer PII, identified from a larger pool of approximately 375,000 records reviewed on the dark web.

When did SBI find out the breach?

SBI received alerts on October 16, 2026 from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In. The stock exchange filing confirming the exposure was made on October 21, 2026.

What data was included in the 3,897 records?

Names, mobile numbers, dates of birth, email addresses, residential addresses, gender, branch identifiers, CIF numbers, lead IDs, and loan application metadata.

Were account balances or banking credentials exposed?

No. SBI confirmed no impact on core banking operations or account balances.

Is this linked to the Crafty Falcon hacking campaign?

No. CERT-In has not linked the exposure to the Crafty Falcon campaign. Attribution is still under investigation.

What should SBI customers do?

Be suspicious of any inbound calls referencing your SBI account or loan details. Never OTPs or PINs. Report suspicious to 1930 or cybercrime.gov.in. Log in directly at sbi.co.in to check account activity.