On October 21, 2026, State Bank of India (SBI) told stock exchanges about an incident involving the loss of certain data. After receiving an alert about records posted on the dark web, the bank said a preliminary review of about 375,000 items identified 3,897 records containing personal information. The link between all of the data and SBI’s systems remains to be established.
What the bank reported
SBI says it was alerted on October 16 by its threat intelligence provider, the Defence Cyber Agency and CERT-In. The bank activated its response procedures and engaged a CERT-In-empanelled cybersecurity agency to assess the authenticity, source and extent of the exposure.
The reported information includes names, phone numbers, dates of birth, email and home addresses, as well as branch and customer file identifiers. SBI has not identified where the records came from or whether an internal system or service provider was involved.
3,897 identified records, not 375,000 confirmed customers
The approximately 375,000 figure describes the larger dataset under review. SBI says it found 3,897 records containing customers’ personal information. The bank has not established what the remaining items contain or publicly confirmed that each one came from its systems.
An actor using the name Siriusim separately claimed to possess a larger set. That claim and the documents it mentioned should not be confused with the scope SBI has confirmed. Public sources also do not show that bank accounts or balances were accessed.
Identified customers were notified
On October 23, SBI said it had individually informed customers whose data was identified, by email or WhatsApp. The bank said balances and funds remained safe and advised customers not to share an OTP, PIN or password.
If a message claims to come from SBI, verify it through the official website or app. Do not call a number in an unexpected text or give a verification code to a caller, even if they know your name, branch or loan details.
What small businesses can learn
A dataset posted online does not always establish where every record originated. During an investigation, organizations should distinguish verified observations, material still under review and claims made by an actor. This avoids reporting a victim count or cause before evidence supports it.
Businesses that handle customer records benefit from knowing where data is stored, which partners can access it and whom to contact when an alert arrives. Keep relevant logs and response contacts available to the people leading an investigation.
The connection with Soclyde
Soclyde can help a small team organise the secrets it uses to access work services. A vault cannot establish where exposed data came from, secure a third party’s banking systems or replace the bank’s fraud protections.
See how Soclyde organises team access, and keep verification details in official channels separate from incoming messages.
What to remember
SBI is investigating data found online. It identified 3,897 records containing personal information within a larger set, without confirming the origin of every item. The bank says it notified the identified customers. To reduce impersonation risks, reject unexpected requests for an OTP, PIN or password and read our password security guide.
