State Bank of India, the country's largest lender with hundreds of millions of customers, is investigating a suspected leak of customer data on the dark web, the bank disclosed to stock exchanges on October 21.
SBI said it received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). A preliminary analysis of about 3.75 lakh records found on the dark web identified 3,897 customer records containing personal information, according to Business Standard. A detailed investigation is under way.
The bank said the incident has not materially affected its core operations, financial performance or business continuity. "We wish to submit that this does not have any material impact" on its core business operations, SBI said in its disclosure.
What data may have been exposed
The records identified so far contain a range of personal details, including registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and customer information file (CIF) identifiers, lead IDs, and metadata linked to loan and lead records.
The data does not appear, based on the disclosure, to include passwords, card numbers or account balances. However, the combination of personal and banking identifiers could be valuable to fraudsters, who often use such information to make phishing calls, messages and emails appear more convincing.
SBI said it must still verify the authenticity and completeness of the data, identify its likely source and the full extent of any exposure, and assess the risks to customers and the bank. Reuters described the incident as a cyberattack involving customer records.
The bank's response
SBI said it has activated its cyber incident response and containment protocols. It has engaged an independent cybersecurity agency empanelled by CERT-In to assess the situation and investigate the alleged compromise, and is implementing remedial and preventive measures as required.
CERT-In, India's national agency for responding to cybersecurity incidents, both alerted the bank and is involved through its empanelled agency. Under Indian rules, organisations must report certain cybersecurity incidents to CERT-In within six hours of becoming aware of them.
The fact that the alert came from multiple sources, including a defence agency, underlines how seriously government bodies are treating threats to critical financial infrastructure.
Why the source matters
One of the most important questions is where the data came from. The presence of lead IDs and metadata linked to loan and lead records suggests the information may relate to systems used to manage prospective customers and loan applications. Such systems are sometimes operated by third-party vendors, sales partners or service providers, which can be weak points in an organisation's security.
Banks increasingly rely on external partners for customer acquisition, collections, technology services and marketing. Each connection creates potential vulnerabilities, and regulators have stepped up scrutiny of how banks manage third-party risks.
Until the investigation is complete, it is unclear whether the records came from SBI's own systems, from a partner, or from an aggregation of data from multiple sources. Data appearing on the dark web is sometimes recycled from older breaches or compiled from different leaks.
A wider pattern of data exposure
The incident is the latest in a series of data security concerns affecting Indian organisations. Large datasets containing personal information of Indian citizens have surfaced on hacker forums in recent years, linked to sources ranging from government portals to telecom operators, healthcare providers and e-commerce companies.
The scale of India's digital economy makes it an attractive target. Hundreds of millions of people use digital banking and payments, and personal information can be used for fraud, identity theft and targeted scams. Cyber fraud cases have risen sharply, with criminals using phone calls, messages and fake apps to trick people into revealing one-time passwords or transferring money.
The regulatory backdrop
India's Digital Personal Data Protection Act, 2023, establishes obligations for organisations that process personal data, including duties to protect data and to notify authorities and affected individuals of breaches. As the rules are implemented, organisations face greater accountability and potential penalties for failures to safeguard personal information.
The Reserve Bank of India has also issued detailed cybersecurity requirements for banks, covering governance, incident reporting, third-party risk management and customer protection. Large banks such as SBI are expected to maintain robust security operations and to report significant incidents to the regulator.
What customers should do
While SBI has not issued specific guidance in its disclosure, standard advice for customers in such situations is to be alert to unsolicited calls, messages and emails claiming to be from their bank, never to share one-time passwords, PINs or passwords, and to verify any request through official channels. Banks do not ask customers to share such information.
Why banks are prime targets
Banks hold some of the most valuable personal data in the economy, including identity details, contact information, account numbers and transaction histories. That makes them attractive targets for cybercriminals, who can use stolen data to commit fraud, impersonate customers or launch targeted phishing campaigns.
India's rapid digitisation of financial services, through mobile banking, UPI and online lending, has brought hundreds of millions of people into the formal financial system. But it has also expanded the attack surface for fraudsters. Cyber fraud complaints have risen sharply in recent years, and regulators have repeatedly urged banks to strengthen their defences, monitor third-party vendors closely and respond quickly to suspected breaches.
Data leaks often originate not from a bank's core systems but from vendors, agents or partners with access to customer information. Identifying the source is therefore crucial to preventing further exposure.
What comes next
The outcome of SBI's investigation will determine the scale of the exposure and whether customers need to take further action. For India's banking sector, the incident is a reminder that protecting customer data is as important as protecting deposits. As digital banking deepens, trust in the security of personal information will be central to the continued growth of India's financial system. Until the investigation concludes, customers are advised to remain alert to unsolicited calls, messages and emails claiming to be from the bank. Genuine bank staff will never ask for passwords, PINs or one-time passwords, and any suspicious contact should be reported through official channels and the national cyber crime helpline.
