SBI probes customer data leak after dark web alert from national cyber agencies

State Bank of India has initiated a forensic probe and notified its insurer following the exposure of customer records on the dark web, moving swiftly to contain the perimeter after receiving alerts from national cybersecurity authorities.

In a regulatory disclosure to stock exchanges, the country’s largest commercial bank stated that it received warnings on 16 October 2026 from the Indian Computer Emergency Response Team (CERT-In), the Defence Cyber Agency, and its threat intelligence service provider. SBI subsequently confirmed the data loss to the exchanges on 21 October, engaging an external specialist agency empanelled by CERT-In to trace the source of the exposure.

What data was exposed on the dark web

The security alert followed claims by a threat actor group that released around 375,000 rows of data and 2,722 PDF files online. Upon scrutinising the leaked files, SBI verified that 3,897 customer records contained personally identifiable details.

The compromised files included customer names, phone numbers, email addresses, dates of birth, residential addresses, and information tied to loan applications. While the wider dump spanned hundreds of thousands of entries, the lender’s initial review confirmed direct customer identity details in nearly 3,900 instances.

Multi-agency coordination and security safeguards

The detection underscores the active monitoring architecture established across India's financial and defence infrastructure, with CERT-In and the Defence Cyber Agency identifying the leak early. SBI has activated its internal incident response framework, tasking independent technical auditors with assessing how the files surfaced outside secured banking environments.

SBI serves roughly 53 crore customers across India, representing about one in every three citizens, and posted a net profit exceeding ₹80,000 crore in the 2026 financial year. Its massive scale makes institutional resilience and rapid institutional response essential to preserving public trust in digital banking channels.

Insurance coverage and next steps

Alongside forensic mitigation, SBI has alerted its state-run cyber underwriter, Oriental Insurance, regarding potential losses connected to the leak. The bank maintains an institutional cyber insurance policy carrying an overall coverage limit of ₹1,425 crore.

Whether an insurance claim is formally lodged will hinge on the full forensic findings, direct financial remediation expenses, and coverage terms for technical liabilities. The bank has not disclosed whether its primary banking systems were breached or whether the files originated from third-party vendor interfaces, with the formal technical audit continuing.