SBI Data Leak: What Indian Firms Should Do This Week

In short: On 21 October 2026, State Bank of India told the stock exchanges it had an incident involving the loss of certain customer data. Reports say 3,897 records with names, mobile numbers, birth dates, addresses and loan details were found on the dark web. The cause is not yet known. Expect impersonation calls and check your own data trail.

When a bank's customer list leaks, the first wave of harm rarely comes from hackers breaking into accounts. It comes from convincing phone calls and messages that quote a person's real name, branch and loan enquiry. Your staff, your customers and your finance team are all likely targets. Here is what has been reported, and what an Indian business or department should do now.

What Happened

According to The Hacker News (21 October 2026), SBI's stock exchange filing dated 21 October says the bank "has experienced an incident involving the loss of certain data". The key reported facts are:

• Alert date: SBI received alerts on 16 October 2026 from its threat intelligence provider, CERT-In and the Defence Cyber Agency, as reported by The Hacker News and SC Media (21 October 2026).
• Scale: Of about 3.75 lakh records examined on the dark web, 3,897 customer records contained personal information. SBI has described the count as preliminary.
• Data reported: names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch and customer (CIF) identifiers, lead IDs and loan-related details.
• Not listed in the filing: account numbers, balances, passwords, OTPs, card details, PAN or Aadhaar numbers, according to The Hacker News.
• Response: SBI activated its incident response procedures and engaged an independent cyber security firm empanelled by CERT-In. The filing says there is no material impact on its operations.

The source of the data has not been identified. SC Media reports that SBI has not yet confirmed the authenticity of the leaked files or the source of the exposure, and the filing does not say whether an SBI system, a subsidiary or a third party was involved. We will not guess. Treat any claim about the cause as unconfirmed until SBI or CERT-In says more.

Who Is Affected

• SBI customers named in the dataset, especially those who made loan enquiries. The bank has not said whether affected customers will be notified individually.
• Businesses whose employees bank with SBI. Leaked personal details make it easier to target your staff with calls that look genuine.
• Finance and accounts teams. Fraudsters often use real details to request "KYC updates", loan processing fees or changes to payment instructions.
• Any organisation that handles loan leads or customer lists, such as dealers, agents, NBFCs, fintech partners and CRM users. This incident is a reminder that lead data travels through many hands.

What It Means for an Indian Business or Department

The reported fields are exactly what a social engineering call needs: a name, a phone number, a date of birth to "verify", and an internal-looking reference such as a branch or lead ID. Even without passwords or card numbers, that is enough to build trust in a call or message and then ask for an OTP, a remote access app or a payment.

The second lesson is about your own data. Lead lists and KYC documents often sit in shared drives, email attachments, spreadsheets with agents and third-party CRMs. Most organisations cannot say how many copies exist. Under the Digital Personal Data Protection Rules, 2025, the main obligations on data fiduciaries, including breach intimation, are due to apply from May 2027. Separately, the CERT-In Directions of April 2022 already require covered entities to report listed incidents within 6 hours. Check with your adviser how these apply to you.

What to Do Now

1. Warn your staff today. Send a short note: the bank will never ask for an OTP, PIN, password or remote access app on a call, and any such request should be reported at once.
2. Lock down payment changes. Require a call-back on a known number before any change to vendor bank details or any urgent payment request, even if the caller quotes correct personal details.
3. Publish your reporting route. Remind employees that cyber fraud can be reported on the national helpline 1930 or at cybercrime.gov.in, and name an internal contact for suspected phishing.
4. Map where your customer and lead data lives. List every system, shared folder, spreadsheet and partner that holds personal data, and remove copies that are no longer needed.
5. Review partner access. Check which agents, vendors and integrations can export customer data, and cut access that is wider than the job needs.
6. Test your incident response. Confirm who would decide, investigate and report if your own data appeared online, and that you could meet CERT-In's 6-hour reporting window.

For the reporting step, use our CERT-In 6-hour incident reporting checklist. To prepare staff for calls like these, see our guide to phishing awareness training for employees.

Frequently Asked Questions

Were SBI account passwords or card numbers leaked?

According to The Hacker News, SBI's filing did not list account numbers, balances, passwords, OTPs, card details, PAN or Aadhaar numbers among the exposed fields. The investigation is still going on, so follow updates from SBI.

How was the SBI data leaked?

This has not been confirmed. SBI's filing does not name a cause, an attacker or whether a third party was involved. An independent CERT-In empanelled firm is investigating.

What should an employee do if they get a suspicious call quoting their details?

End the call, do not share any OTP or install any app, call the bank on the number printed on its official website or card, and report the attempt to your IT team and on the 1930 helpline.

How Affix Center Can Help

Affix Center helps Indian organisations and government departments find where personal data sits, tighten access, run phishing awareness programmes and prepare incident response and CERT-In reporting. Learn more about our cyber security services.

If this news has raised questions about your own customer data, contact our team for a quick review.