In October 2026, State Bank of India confirmed that some customer data had turned up on the dark web. If you bank with SBI, there is no need to panic, but there is good reason to be alert. Here is what is known so far and what to do.
What happened
On 16 October 2026, SBI was alerted to the leak by its threat intelligence provider, CERT-In and the Defence Cyber Agency.
On 21 October 2026, SBI said in a stock exchange filing that it had "experienced an incident involving the loss of certain data".
In a set of about 3.75 lakh records found on the dark web, SBI's preliminary analysis identified 3,897 customer records containing personal information.
The exposed fields reportedly include names, gender, registered mobile numbers, dates of birth, email addresses, residential addresses, branch and CIF identifiers, and details linked to loan or lead records.
The filing did not list account numbers, balances, passwords, OTPs, card details, PAN or Aadhaar numbers among the exposed fields.
SBI says it has activated its incident response, hired a CERT-In empanelled cybersecurity firm, and is still checking whether the data is authentic and complete.
Why it matters for you
A leak like this doesn't mean your account has been hacked. The bigger risk is impersonation. A scammer who knows your name, mobile number, date of birth and branch can sound very convincing on a call or in an SMS that claims to be from SBI. Use this checklist:
Never share your OTP, ATM PIN, UPI PIN, CVV or banking password. SBI says it will never ask for these.
Don't click links in SMS, email or WhatsApp messages asking you to update KYC. Open the SBI website or YONO app yourself instead.
Treat "KYC expiring" or "account blocked" calls as fake until proven otherwise. Hang up and call the bank's official number from its website or the back of your card.
Verify through official channels only. Never call a number given in a suspicious message.
Don't install apps a caller asks you to install. Screen-sharing and remote-access apps are a common way fraudsters take over phones.
Set transaction limits in the YONO app. Lower daily limits reduce the damage if something goes wrong.
Lock your Aadhaar biometrics. You can do this through the official mAadhaar app or the UIDAI website, and unlock them when you need them.
Keep your UPI PIN different from your phone PIN. Remember that a PIN is only needed to send money, never to receive it.
Report fast. If you lose money, call the cybercrime helpline 1930 immediately or file a complaint at cybercrime.gov.in, and inform SBI. Forward phishing emails and messages to report.phishing@sbi.co.in. To report a suspicious call or SMS where you haven't lost money, use the Chakshu facility on the Sanchar Saathi portal.
Share this list with older family members. They are often the main target of "bank official" calls.
What to watch next
Whether SBI confirms that the leaked data is genuine, and how many people are affected
Whether SBI notifies affected customers directly, which the filing did not say
Any guidance from CERT-In or the RBI on the incident
Sources
SBI admits data breach: 3,75,000 customer records leaked on dark web (ETV Bharat)
Chakshu: report suspected fraud communication (Sanchar Saathi)
Found this useful? Follow @kevinsingh.me on Instagram for a new money, career or startup tip every day, and subscribe so you don't miss the next one.