SBI and Bank of Baroda Leaks, 5.7 Lakh Banking Cyber Incidents — Is This a "Digital Pandemic"?
Banking · Cyber security · India 2026
Bank Data Breaches in India: SBI and Bank of Baroda Leaks, 5.7 Lakh Banking Cyber Incidents — Is This a “Digital Pandemic”?
Three public sector banks reported cyber incidents in four months of 2026, as government data show banks face more attack attempts than any other sector.
Your balance is intact. Your bank says its core systems are safe. And yet your name, mobile number, date of birth, home address and loan details may be sitting in a file on a criminal forum. That is the uncomfortable reality behind India’s latest wave of bank data leaks, and it explains why the phrase “digital pandemic” keeps coming up when people describe the problem.
The comparison is a metaphor, but it fits. A pandemic means constant exposure, repeated waves, unaware carriers and damage that shows up weeks later. All of that now describes India’s banking data.
The Infection Curve: How Often Banks Are Being Probed
The clearest data come from the government itself. Replying in Parliament, Minister of State for Electronics and IT Jitin Prasad shared CERT-In figures showing that the banking sector logged 5,70,108 cyber security incidents in 2025 and 3,48,607 between January and June 2026. That made banking the most-hit of the two sectors covered in the reply. Healthcare, the other, recorded 34,480 incidents in 2025.
- 4,70,445Malicious scanning and probing incidents in finance, 2025
- 99,663Vulnerable-service incidents in finance, 2025
- 39Targeted intrusion campaigns against banks, 2025
- 17Targeted intrusion campaigns, January to June 2026
- 29.44 lakhCyber incidents handled by CERT-In across all sectors, 2025
- 6 hoursDeadline to report specified incidents to CERT-In
Most “incidents” are not breaches. Scanning and probing is like someone trying every door handle on a street: relentless, automated and mostly unsuccessful. The figures that matter more are the targeted intrusion campaigns — 39 in 2025 and 17 in the first half of 2026 — because those are organised, deliberate attempts to get inside a bank.
Cyber security incidents detected by CERT-In, as stated in Parliament. Bars scaled to banking 2025.
Our calculation: the curve is steepening. 5,70,108 incidents across 365 days in 2025 is about 1,562 a day. 3,48,607 incidents across the 181 days from January to June 2026 is about 1,926 a day. That is a rise of roughly 23% in the daily rate, which is why the pandemic comparison resonates: the exposure is not only constant, it is growing.
Independent research points the same way. A joint report by Boston Consulting Group and the Data Security Council of India, released in May 2026, found that India’s banking, financial services and insurance sector faces cyberattacks at 1.6 times the global average, with incidents rising from 1.4 million in 2021 to 2.9 million in 2025. It also put the mean time to contain a breach in India at 263 days.
Wave After Wave: The 2026 Bank Incidents
Each 2026 incident followed one script: a forum claim, an exchange filing, assurances, and a long probe.
Bank of Baroda: one mailbox, one big claim
On 27 July 2026, Bank of Baroda told the exchanges about a cyber security incident, naming a preliminary cause of potential business email compromise. A group calling itself TripleX had listed the bank on a leak site days earlier, on 24 July, claiming close to 1,000GB of data. The bank said it contained the incident promptly and that its core banking systems were not accessed. The size and authenticity of the claimed data have not been independently verified.
SBI: 3,897 real customers inside a bigger pile
State Bank of India said it became aware on 16 October 2026, after an alert, of a suspected exposure of customer data on the dark web. In its filing on 21 October, the bank said a preliminary analysis of about 3.75 lakh records had identified 3,897 customer records with personal information. Exposed fields included names, registered mobile numbers, dates of birth, email and home addresses, branch and customer identification (CIF) numbers, and details linked to loan and lead records.
SBI said the incident had no material impact on its operations or finances and appointed an independent CERT-In-empanelled agency to investigate. How the data left the bank, or a vendor working for it, has not been established. For a bank with more than 50 crore customers, 3,897 is tiny. For those 3,897 people, it is everything.
Central Bank of India: when money did move
The third case was different, because money moved. About ₹13.97 crore was allegedly diverted through 187 unauthorised transactions between 15 and 17 October 2026, linked to the bank’s settlement account. The bank attributed it to a technical glitch in its RTGS outward system and said customers suffered no loss. Mumbai’s Nodal Cyber Police registered a case against unknown persons.
| Incident | When | What was exposed or moved | Scale | Bank’s position |
|---|---|---|---|---|
| Debit card malware breach | Reported Oct 2016 | Card data across several banks | About 32 lakh debit cards | SBI blocked and replaced almost 6 lakh cards |
| All banks, Parliament tally | Jun 2018 to Mar 2022 | Business and personal data | 248 breaches | 205 at private banks, 41 at public sector banks, 2 at foreign banks |
| Bank of Baroda | Filed 27 Jul 2026 | Data reached via one employee email account | Claim of close to 1,000GB, unverified | Contained; core banking not accessed |
| Central Bank of India | 15 to 17 Oct 2026 | Funds from settlement account | ₹13.97 crore, 187 transactions | RTGS glitch; no customer loss |
| State Bank of India | Filed 21 Oct 2026 | Names, mobiles, DOB, addresses, CIF, loan data | 3,897 of about 3.75 lakh records | No material impact; forensic probe on |
Why “Core Systems Are Safe” Is Not the Reassurance It Sounds Like
Every bank statement this year stressed that core banking was untouched. That is true and important: nobody’s balance was rewritten. But it misses how modern fraud works. Criminals rarely need to break into a core banking system. They need your identity details, so they can convince you, or a call centre agent, that they are legitimate.
A fraudster who knows your name, your branch, your loan account and your date of birth can make a “bank officer” call sound flawless. That is the real damage of a leak like SBI’s, and it arrives later, the way symptoms follow infection. The RBI’s Currency and Finance report for 2023-24 found that phishing was the most common data breach attack vector in India at 22%, followed by stolen or compromised credentials at 16%. Leaked data feeds both.
What people get wrong: assuming that if no money left your account, the breach did not affect you. Leaked personal data has a long shelf life. Expect targeted calls, SMS messages and emails using your real details for months, and treat any unexpected contact quoting your account information as suspect.
Incidents observed by threat-intelligence firm CYFIRMA, March to August 2026. Indicative, not a full census. Total is our sum.
The weak points are people and partners
Look at how the 2026 incidents began. Bank of Baroda traced its problem to one employee email account. SBI has not said whether its data came from its own systems, a subsidiary or a third-party vendor that handles loan applications. Every vendor with access to customer files is a potential carrier.
A Puzzle in the Fraud Data
If attacks are rising, you would expect reported frauds to rise too. The RBI’s Annual Report for 2025-26 tells a more complicated story. Total fraud cases fell to 10,114 in 2025-26 from 23,722 the year before and 35,800 in 2023-24. But the amount involved jumped to ₹48,021 crore, from ₹32,803 crore in 2024-25 and ₹11,013 crore in 2023-24.
RBI Annual Report 2025-26. Amounts in ₹ crore, scaled to 2025-26. Card, internet and digital payment frauds shown separately.
Two details explain most of the jump in value. Loan-related frauds, in the “advances” category, made up ₹40,774 crore of the 2025-26 total. And the RBI said the 2025-26 data include 314 cases worth ₹30,199 crore from earlier years, reported afresh after re-examination following a Supreme Court ruling.
The fall in card, internet and digital payment fraud cases to just 293 needs caution. RBI figures cover frauds reported by banks under its own classification, not every scam that empties an account, and we could not confirm what drove the drop.
The Rules Catching Up
- About 32 lakh debit cards compromised in a malware breach.
- CERT-In directions require incidents to be reported within 6 hours.
- DPDP Rules notified; Data Protection Board set up a day earlier.
- RBI issues draft rules on customer liability in digital fraud.
- RBI finalises the revised liability framework.
- Bank of Baroda listed on a leak site, then confirms an incident.
- ₹13.97 crore moved in 187 transactions at Central Bank of India.
- SBI alerted to dark-web data, then discloses 3,897 records.
- New RBI liability rules apply to electronic transactions.
- Remaining DPDP Act provisions take effect.
RBI: the bank must prove you were careless
The RBI issued its revised framework on 24 June 2026, and it applies to electronic banking transactions from 1 January 2027. It places the burden of proving customer liability on the bank. Customers have zero liability where fraud arises from the bank’s negligence, and also in third-party breaches if they report within five calendar days of the bank’s communication. Banks get 30 calendar days to investigate and decide.
There is also a new compensation scheme for small frauds. Eligible victims receive 85% of the net loss or ₹25,000, whichever is lower, where the fraud does not exceed ₹50,000 and is reported to the bank and to the cybercrime portal or helpline 1930 within five calendar days. Banks must also send instant SMS alerts for electronic transactions above ₹500.
Worked example, our calculation: a customer loses ₹20,000 to a fraudulent transfer in February 2027 and reports it on day 2. Under the compensation formula, 85% of ₹20,000 is ₹17,000, which is below the ₹25,000 cap, so ₹17,000 is the compensation figure. A ₹40,000 loss gives 85% of ₹34,000, capped at ₹25,000. A ₹60,000 loss is above the ₹50,000 ceiling and falls outside the scheme, though the wider liability rules still apply.
| Your situation (from 1 Jan 2027) | Report within | Your liability | Bank’s deadline |
|---|---|---|---|
| Fraud caused by bank negligence | Any time, but report at once | Zero | 30 calendar days to decide |
| Third-party breach, e.g. a vendor leak | 5 calendar days | Zero | 30 calendar days to decide |
| Small fraud up to ₹50,000 | 5 calendar days, to bank and 1930 | Compensation of 85%, max ₹25,000 | 30 calendar days to decide |
| Fraud after you have reported | Already reported | Borne by the bank | Must act immediately |
| Claim rejected | Not applicable | Bank must give reasons and logs | Within the 30-day decision |
DPDP: big penalties, but the clock has not fully started
The Digital Personal Data Protection Rules, notified on 14 November 2025, require organisations to tell affected individuals about a personal data breach without delay and to send the Data Protection Board a detailed report within 72 hours. Under the Act, failing to keep reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to notify a breach up to ₹200 crore. The remaining substantive provisions take effect on 13 May 2027, so the full penalty regime is not yet live.
- 0 to 6 hrsTell CERT-InSpecified cyber incidents must be reported within 6 hours.
- Without delayTell customersDPDP Rules require plain-language notice to each person affected.
- 72 hrsReport to the BoardDetailed breach report to the Data Protection Board.
- 30 daysSettle fraud claimsRBI deadline for deciding customer liability from 2027.
What We Know
- CERT-In detected 5,70,108 banking incidents in 2025 and 3,48,607 in January to June 2026.
- SBI found 3,897 customer records with personal data in about 3.75 lakh leaked records.
- Bank of Baroda traced its July incident to one compromised employee email account.
- Central Bank of India saw ₹13.97 crore moved in 187 transactions and says customers lost nothing.
- New RBI liability rules apply from 1 January 2027.
What Is Still Unclear
- How SBI’s data left the bank, a subsidiary or a vendor.
- Whether affected SBI customers will be individually told; the filing did not say.
- The true size of the Bank of Baroda leak; the 1,000GB claim is unverified.
- Why reported digital payment frauds fell to 293 cases in 2025-26.
- Some later reports cite 4,280 SBI customer records; the bank’s filed figure is 3,897.
Your Personal Vaccination Plan
No single habit makes an account breach-proof, but layered protection makes you a far harder target.
- Assume your basic details are already known. Never treat a caller as genuine because they quote your name, account or loan number.
- Do not share an OTP, PIN, CVV or UPI PIN with anyone. Banks do not ask for them.
- Turn on SMS and email alerts for every transaction, and set low limits for online and card spending you rarely use.
- If money leaves your account without your consent, call 1930 or file at cybercrime.gov.in, and inform your bank the same day. From 2027, the 5-day window decides compensation.
- Get every complaint in writing, keep the reference number, and escalate to the RBI Ombudsman if the bank does not settle it.
- Freeze or lock cards you are not using, and check your credit report for loans you never took.
Frequently Asked Questions
Was my money stolen in the SBI data leak?
SBI has said the incident has no material impact on its operations and no direct loss of customer funds has been reported. The exposed data was personal information such as names, mobile numbers, dates of birth, addresses, CIF numbers and loan details, which can be misused for phishing.
How many SBI customers were affected by the data breach?
In its 21 October 2026 filing, SBI said preliminary analysis of about 3.75 lakh records found on the dark web identified 3,897 customer records with personal information. The investigation was continuing, and the source of the data has not been confirmed.
What happened in the Bank of Baroda data breach?
Bank of Baroda reported a cyber security incident on 27 July 2026, linked to a compromised employee email account. A group claimed to hold close to 1,000GB of data, which has not been verified. The bank said core banking systems were not accessed.
How many cyber attacks do Indian banks face?
CERT-In detected 5,70,108 cyber security incidents in the banking sector in 2025 and 3,48,607 between January and June 2026, according to figures given in Parliament. Most are scanning and probing; targeted intrusion campaigns numbered 39 in 2025 and 17 in the first half of 2026.
Will the bank refund money lost to cyber fraud?
Under RBI rules applying from 1 January 2027, you have zero liability if the fraud results from the bank’s negligence, or from a third-party breach reported within five calendar days. Small frauds up to ₹50,000 can get compensation of 85% of the loss, capped at ₹25,000, if reported within five days.
Where do I report bank fraud in India?
Call the national cybercrime helpline 1930 or file a complaint at cybercrime.gov.in, and inform your bank immediately through its official channels. Keep the complaint reference numbers, since timely reporting affects your liability.
Do banks have to tell customers about a data breach?
The DPDP Rules require organisations to inform affected individuals without delay and to file a detailed report with the Data Protection Board within 72 hours. Remaining provisions of the DPDP Act take effect on 13 May 2027.
What is the penalty for a bank data breach under the DPDP Act?
Failure to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore, and failure to notify a personal data breach up to ₹200 crore, imposed by the Data Protection Board of India.
The Short Version
India’s banks are not facing one outbreak but a constant one. CERT-In logged more than 1,900 banking incidents a day in the first half of 2026 by our calculation, and three public sector banks reported incidents within four months. Most attempts fail, and core systems have held. But leaked personal data is the real contagion, because it powers the convincing scam call that comes later. The RBI’s new rules from 1 January 2027 shift more responsibility to banks, and the DPDP Act adds heavy penalties. Until then, your best protection is to report fast and trust no unexpected caller.
