What SBI Actually Disclosed

The confirmation came through a regulatory channel, not a customer notice. On 21 October 2026, SBI filed a disclosure with the BSE and the National Stock Exchange, as listed companies must when a material event occurs. According to The Hacker News, the filing said the bank “has experienced an incident involving the loss of certain data.”

The bank said it had been alerted on 16 October by three sources: its threat intelligence service provider, CERT-In, which is India’s national cyber security agency, and the Defence Cyber Agency. Its preliminary analysis of about 3.75 lakh records found on the dark web identified 3,897 that contained personally identifiable information. The Week reported the full list of fields: registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file identifiers, lead IDs, and metadata tied to loan records and related files.

SBI said it had activated its cyber incident response and containment protocol, appointed an independent cyber security agency empanelled by CERT-In to assess “the alleged compromise”, and that “a detailed assessment is currently underway”. It also said the incident has no material impact on its core business operations, financial performance or business continuity. That statement is about the bank’s finances, not about the risk to individual customers.

What the filing did not say

SBI’s disclosure does not name an attacker, a forum or a cause. It does not say whether the bank’s own systems were breached, whether a vendor or subsidiary was involved, or whether the 2,722 documents the poster claims to hold were examined. It does not say whether customers have been or will be contacted. The Hacker News notes that, by contrast, Bank of Baroda’s filing in July 2026 gave a preliminary cause: a potential business email compromise.

The Dark Web Listing Behind the Alarm

The data first surfaced publicly before SBI said anything. On 16 October, a cyber security account on X called CyberPulse56 flagged a post by a threat actor using the name “Siriusim” on BreachForums, a well-known cybercrime forum. Free Press Journal reported that the poster claimed 3.75 lakh rows of data in spreadsheet format and 2,722 PDF documents.

According to the same report, the claimed documents included loan applications, supporting financial documents, account opening forms, identity details and residential addresses. One sample was an employment and income declaration listing an employer, designation, work experience and salary. Sample fields also included occupations, nominees, IFSC codes and CKYC and video KYC details. Free Press Journal said some records related to savings account applications and customer onboarding, not only loans.

Is the data real?

Partly verified, at most. Free Press Journal examined 4 sample records published openly on the forum. The phone numbers were valid, and in one case the person’s WhatsApp profile photo matched the passport-size photo on their KYC document. That suggests at least some records belong to real people. It does not prove the whole dataset is genuine, that it came from SBI rather than a subsidiary or partner, or that it is recent. SBI’s own count of 3,897 records with personal information is described as preliminary.

The gap between 3.75 lakh rows and 3,897 personal records is worth understanding. Large leaked datasets often contain duplicate rows, partial entries, system logs or records with no identifying details. SBI’s figure means about 1 in 100 rows contained what the bank classifies as personally identifiable information. It does not necessarily mean the other rows are harmless; it means they did not meet that definition in the first review.

Is Everything Gone? Separating Fear From Fact

The fear behind “is everything gone?” is that someone can now empty your account. Based on SBI’s disclosure, that is not what these fields allow on their own. Moving money out of an SBI account requires credentials that are not in the listed data: your internet banking password, your UPI PIN, your debit card PIN, or a one-time password sent to your phone at the moment of a transaction.

Your deposits are also not affected by the leak in the way a bank failure would affect them. The bank itself is not in trouble; SBI says operations and finances are not materially affected. Money in your account remains your money, held by the bank, whatever happens to a spreadsheet on a criminal forum.

How an Impersonation Scam Unfolds

The Hacker News summed up the risk plainly: scammers can use a customer’s name, mobile number, date of birth, address, branch and internal ID to appear to be from the bank. The Internet Freedom Foundation, in its statement of 21 October, made the same point, warning that leaked details let fraudsters impersonate bank officials. Most such scams follow a predictable script.

Variations to expect in the coming weeks

Fraudsters often adapt their scripts to whatever is in the news. Expect messages that mention the leak itself: “Your SBI data has been compromised; click here to secure your account” or “Verify your identity to avoid account freeze”. Expect fake loan offers aimed at the people whose loan lead data appears in the dump, promising a quick top-up for a processing fee. Expect emails with SBI logos asking you to “update KYC” through a link. Each of these is designed to get you to hand over credentials or install software. SBI will not ask you to do any of these things through a link or an unsolicited call.

SIM swap: the quieter threat

Your registered mobile number is the key that receives OTPs. If a fraudster convinces a telecom store to issue a duplicate SIM in your name, using details such as your name, address and date of birth, they can receive your bank’s OTPs. Warning signs include your phone suddenly losing network for no reason. If that happens, contact your telecom operator immediately from another phone and alert your bank.

Your First 24 Hours

You do not need to close your SBI account. The Week reported that affected customers do not need to do so. What you need is a few quick protective steps, most of which take minutes.

The RBI Rule That Protects Your Money

If fraud does happen, Indian banking rules put much of the responsibility on the bank, provided you act fast. Under the RBI’s 2017 framework on customer liability for unauthorised electronic transactions, a customer has zero liability when the fraud results from a lapse by the bank, or from a breach elsewhere in the system where the customer reports within 3 working days of being informed. Reporting within 4 to 7 working days limits liability to a fixed cap that depends on the account type.

Beyond 7 working days, liability is decided by the bank’s board-approved policy. The same rules require the bank to credit the disputed amount to your account, as a provisional “shadow” credit, within 10 working days of your report, and to resolve the complaint within 90 days.

The key exception is negligence. If you share a password, PIN or OTP, the loss up to the point of reporting may be yours. That is why the single most important rule after this leak has not changed: whoever calls, whatever they know about you, never share those codes.

The Five-Day Gap and the Notification Question

The incident has raised a sharp debate about disclosure. The Wire reported that SBI filed its exchange disclosure five days after the first alert, and that the bank learned of the leak from outside sources rather than detecting it itself. The Internet Freedom Foundation said SBI had told the stock exchanges but not the customers whose data was leaked, and that no customer notice, press release or advisory about the 3,897 customers was publicly available.

What the rules require, and when

The IFF set out the legal position in its statement, as reported by The Wire. CERT-In’s April 2022 directions require cyber incidents to be reported to CERT-In within six hours. The RBI’s cyber security framework requires an initial report to the RBI within two to six hours. Section 8(6) of the Digital Personal Data Protection Act, 2023 requires an organisation to inform both the Data Protection Board and each affected person of a personal data breach, but that provision only takes effect in May 2027 under the staggered commencement. An RBI advisory of March 2026 recommends that banks notify affected customers.

The Week reported that, under Indian cyber security protocols, banks must notify affected customers by registered email or SMS. Whether SBI has started doing so is not public. The IFF has asked the bank for six things: direct notice to every affected customer in multiple languages, a helpline or online check, disclosure of what the documents contain including whether they hold Aadhaar, PAN or passport copies, an explanation of how the data left the bank, confirmation of compensation under RBI rules, and confirmation of whether it followed the RBI’s March 2026 advisory.

Congress Rajya Sabha MP Pawan Khera said SBI “did not even detect the breach itself” and that “SBI owes its customers answers”. SBI’s position, in its filing, is that a detailed assessment is under way and that it engaged independent experts. Both sides agree on one point: the source of the data is not yet known.

Am I One of the 3,897?

There is currently no public tool to check. SBI has not published a lookup, and the IFF’s demand for a helpline or online check suggests none exists yet. The honest answer for any individual SBI customer is that you probably are not among them, but you cannot be sure.

Some groups have more reason to be alert. Free Press Journal’s review of the samples suggests loan leads, loan applications and account opening records are involved. If you applied for an SBI loan, opened an account through a lead or agent, or went through video KYC in recent years, treat yourself as potentially exposed. Everyone else should still take the basic steps, because leaked data tends to be copied, combined with other datasets and reused for years.

Not the First, and Not Only SBI

Large Indian banks have faced data incidents before, and some claims have later been denied or never confirmed. Business Standard compiled recent cases on 22 October 2026. The pattern is consistent: the risk to customers usually comes less from the leak itself than from what fraudsters do with it afterwards.

SBI itself faced scrutiny in 2019, when Business Insider and others reported that an unsecured server linked to an SBI messaging service had exposed customer information. Each episode has reinforced the same lesson for customers: the moment a leak is reported is the moment fraud calls tend to increase.

Your 7-Day and 3-Month Plan

Most of the risk from leaked personal data plays out over months, not days. A short routine, set up now, reduces it sharply.

Within 7 days

Download your credit report from one of the credit bureaus and check for any loan or credit card you did not apply for. If you find one, dispute it with the bureau and the lender immediately. Update your SBI email and mobile details if they are outdated, so alerts reach you. Make sure your nominee details are current. If you use the same password for email and banking, change both, because email access is often the route to resetting bank passwords.

Over the next 3 months

Read every bank statement line by line, not just the balance. Treat every unsolicited call, SMS, email or WhatsApp message that mentions SBI as suspicious until you have verified it through the official app, website or branch. Watch for unexplained loss of mobile network, which can signal a SIM swap. Tell elderly relatives again, because fraudsters often target older customers with the most convincing scripts.

Who to Contact, and How

When you need to reach SBI, use only contact details you find yourself on the official sbi.co.in website or inside the YONO app, never a number given in an SMS, email or call. The Week and The Hacker News reported SBI’s existing advice to report phishing to [email protected], and to call 1930 if money has been taken.