Skip to content
SBI Investigates Dark Web Data Exposure of Customer Records

SBI Investigates Dark Web Data Exposure of Customer Records

First seen 27 Oct 2026, 05:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 05:17 UTC
  • •SBI is investigating a data exposure incident involving 3,897 customer records on the dark web.
  • •The bank's preliminary review indicates the data may originate from loan-sourcing or lead-management systems.
  • •SBI has established a cybersecurity centre, CyRIS, to bolster its defenses against emerging threats.

The State Bank of India (SBI) is investigating the suspected exposure of customer data on the dark web, with 3,897 records containing personally identifiable information identified among approximately 375,000 records. The bank received alerts from its threat intelligence service provider, the Defence Cyber Agency, and CERT-In on October 16, 2026. Preliminary findings do not confirm that all records belong to SBI customers, and the investigation is ongoing to determine the authenticity and source of the data. SBI has activated its cyber incident response protocols and engaged an independent cybersecurity agency. The exposed data includes names, birth dates, and loan-related metadata, suggesting a potential link to loan-sourcing or lead-management systems rather than core banking systems. SBI has launched a cybersecurity centre, CyRIS, to enhance its digital security capabilities in response to this incident.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-10-16
SBI alerted to data exposure
SBI received notifications from its threat intelligence provider, Defence Cyber Agency, and CERT-In regarding customer data found on the dark web.
The420.In
2026-10-21
SBI discloses data exposure findings
SBI reported identifying 3,897 customer records with personally identifiable information among 375,000 records on the dark web.
Crnasia
2026-10-27
SBI launches CyRIS cybersecurity centre
In response to the data exposure incident, SBI inaugurated CyRIS to enhance its cybersecurity capabilities and address emerging threats.
The420.In

More articles in this cluster (3)

Following this threat?

Track State Bank Of India in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 4

Common questions

What customer data was exposed?
The exposed data includes names, birth dates, registered mobile numbers, email addresses, and loan-related metadata.
Is there evidence of exploitation?
The investigation is ongoing, and there is currently no confirmed evidence of exploitation in the wild.
What actions is SBI taking in response?
SBI has activated its cyber incident response protocols and established a cybersecurity centre, CyRIS, to enhance its security capabilities.