State Bank of India (SBI) has begun individually notifying customers identified in a recent cyber incident involving possible exposure of personal information on the dark web. In an October 23, 2026 update, the bank said affected customers had been contacted through email and/or WhatsApp, while reiterating that their account balances and funds remain safe.
The development follows SBI’s October 21 stock exchange disclosure, which reported that a preliminary review of approximately 375,000 records found on the dark web had identified 3,897 customer records containing personally identifiable information.
The information included names, mobile numbers, dates of birth, email addresses, residential addresses and certain banking-related identifiers. SBI has engaged an independent cybersecurity agency to investigate the source, authenticity and full extent of the reported exposure.
The bank has not reported a material impact on its core banking operations, financial performance or business continuity. It has also not identified a confirmed entry point, exploited vulnerability or malware family behind the incident.
For customers, the immediate concern is potential misuse of personal details in targeted phishing or impersonation attempts, not evidence that bank account balances have been stolen.
For broader context on how organizations investigate confirmed and suspected data exposure, read our Data Breach Coverage and Incident Response Guide.
Key Findings From the SBI Cyber Incident
- Customer notification: On October 23, SBI said customers identified as involved had been contacted individually by email and/or WhatsApp.
- Records reviewed: Approximately 375,000 records reportedly found on the dark web.
- Customer PII records identified: 3,897 in the bank’s preliminary analysis.
- Potentially exposed details: Names, contact information, dates of birth, addresses and certain customer or loan-related identifiers.
- Bank’s reassurance: Customer account balances and funds remain safe.
- Operational impact: SBI reports no material disruption to core operations or business continuity.
- Investigation: An independent CERT-In-empanelled cybersecurity agency is examining the data’s authenticity, source and scope.
SBI Data Breach: What the Bank Told Customers on October 23
SBI issued a customer communication on October 23 confirming that it had individually informed customers whose data had been identified as involved in the recent incident.
The bank said the notifications were delivered through email and/or WhatsApp.
It also sought to reassure account holders that their funds and account balances were safe.
This is an important development because the bank’s earlier stock exchange filing focused on the data-loss incident, its preliminary findings and the investigation.
The October 23 communication specifically addresses how the bank has contacted people identified during its assessment.
However, the announcement does not establish that every person potentially referenced in the larger dark web dataset has been individually identified or contacted.
Customers should also distinguish an official bank notification from a message merely claiming to be from SBI.
Fraudsters may exploit public attention surrounding the incident by impersonating bank officials and sending convincing account-verification requests.
Why SBI Identified 3,897 Records Among 375,000 Entries
The figures disclosed in the incident refer to different things.
SBI’s preliminary examination reviewed approximately 375,000 records reportedly available on the dark web.
Within that material, investigators identified 3,897 customer records containing personally identifiable information.
| Figure | What It Represents | What It Does Not Prove |
|---|---|---|
| Approximately 375,000 | Records examined during the preliminary review | That 375,000 SBI customers were compromised |
| 3,897 | Customer records containing PII identified in the preliminary analysis | The final number of affected individuals |
| October 16 | Date SBI received external alerts about suspected exposure | The date the underlying data was necessarily stolen |
| October 21 | Date of SBI’s stock exchange disclosure | The date the alleged intrusion necessarily occurred |
| October 23 | Bank’s update confirming direct customer notifications | That its forensic investigation is complete |
These distinctions matter because a collection of records may contain duplicates, unrelated material or information whose origin has not yet been established.
The bank’s independent investigation is intended to determine the authenticity and completeness of the information, its possible source and the true extent of the exposure.
Until that work is completed, the larger dataset should not be reported as a confirmed count of compromised customer accounts.
What SBI Customer Information May Have Been Exposed?
According to SBI’s October 21 disclosure, the identified records included several categories of personally identifiable information.
- Customer names.
- Registered mobile numbers.
- Dates of birth and gender.
- Email addresses.
- Residential addresses.
- Branch-related information.
- Customer Information File identifiers, commonly called CIF numbers.
- Lead identifiers and metadata associated with loan-related records.
Personal information of this kind can be valuable to criminals because it helps make fraudulent messages appear convincing.
For example, a scammer who knows a person’s name, bank association and loan-related details may attempt to impersonate a genuine customer support representative.
But the disclosure does not establish that account passwords, internet banking PINs, OTPs or transaction credentials were included in the identified exposure.
Similarly, the presence of a customer identifier is not evidence that an attacker can directly withdraw money from an account.
These risks should be evaluated separately.
Are SBI Account Balances and Customer Funds Safe?
In its October 23 communication, SBI reiterated that customers’ account balances and funds remain safe.
The bank also previously reported that the incident had not materially affected its core banking operations, financial performance or business continuity.
This means the reported personal-data exposure should not be confused with a confirmed compromise of SBI’s transaction-processing systems.
There is no evidence in the bank’s cited disclosures that every affected customer’s account was accessed without authorization or that money was withdrawn as part of the incident.
Nevertheless, customers should continue normal account monitoring.
If an unexpected transaction appears, they should report it immediately through SBI’s authenticated fraud-reporting channels.
Even when account balances remain secure, exposed personal details can still create a separate phishing and identity-fraud risk.
How the SBI Cyber Incident Was Discovered
SBI said it received communications concerning suspected customer data exposure on October 16, 2026.
The alerts came from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, known as CERT-In.
After receiving the information, the bank activated its cybersecurity incident-response and containment procedures.
It subsequently engaged an independent cybersecurity agency empanelled by CERT-In to examine the suspected exposure.
The investigation is intended to determine whether the data is authentic, how it became available, how much information may be involved and what risks arise for customers and the bank.
SBI disclosed the incident to stock exchanges on October 21 under the applicable SEBI listing disclosure framework.
The October 23 customer-notification announcement represents a further step in the bank’s response.
Did Hackers Breach SBI’s Core Banking Systems?
The public disclosures reviewed do not establish that attackers gained access to SBI’s core banking infrastructure.
Nor do they identify a specific compromised database server, application vulnerability, third-party system or stolen administrator credential.
Those details remain important because information can appear on a criminal marketplace through different routes.
Possible scenarios in data-exposure investigations can include direct intrusions, compromised vendors, unauthorized access through connected systems or reuse of previously exposed data.
However, none of those possibilities should be presented as the confirmed cause of this SBI incident without evidence.
At this stage, the appropriate conclusion is that SBI disclosed a data-loss incident and is investigating the origin and scope of the material.
What About Claims of 375,000 SBI Customer Records and Banking Documents?
Separate public reporting has described a threat actor using the name Siriusim and alleging possession of a larger SBI-related dataset.
Some reports reference approximately 375,000 data rows and thousands of PDF documents allegedly containing banking-related records.
These are threat-actor allegations and should not be combined with SBI’s confirmed preliminary findings.
The bank’s exchange disclosure refers to an initial review of roughly 375,000 records and identifies 3,897 customer PII records.
It does not validate every element of the alleged criminal dataset.
The bank has not publicly confirmed that the named threat actor entered its internal banking systems or that all claimed documents were stolen directly from SBI.
Until independent forensic evidence establishes the origin and authenticity of the material, the larger claims remain separate from the bank’s verified disclosures.
How to Verify an SBI Cyber Incident Notification
Because SBI has reported contacting customers through email and WhatsApp, criminals may attempt to imitate these notifications.
Customers should verify unexpected messages carefully, even if a message mentions accurate personal details.
1. Avoid Opening Suspicious Verification Links
Do not click an unfamiliar link simply because it claims to provide details about the SBI data leak.
Instead, open the official SBI website or the bank’s trusted mobile application directly.
2. Never Share OTPs, PINs or Passwords
Do not disclose internet banking passwords, ATM PINs, OTPs or other authentication codes to anyone claiming to investigate the incident.
A message requesting those details should be treated as suspicious regardless of the sender’s displayed name.
3. Verify Requests Independently
Use contact information obtained from SBI’s official website, approved mobile application or existing bank documents.
Do not rely only on a phone number or website supplied inside an unexpected message.
4. Review Recent Account Activity
Check transaction alerts and account statements for unfamiliar activity.
If unauthorized transactions are identified, report them immediately through official fraud-reporting channels.
5. Report Suspicious Messages
SBI’s cybersecurity guidance includes reporting options for phishing incidents. Customers in India can also report financial cyber fraud through the national cybercrime helpline at 1930.
For other suspected online crimes, use the Government of India’s official National Cyber Crime Reporting Portal.
These precautions are important even for customers who have not received an identified-exposure notification.
Does Receiving an SBI WhatsApp Message Mean Your Account Was Hacked?
No. A legitimate data-exposure notification does not automatically indicate that an account has been taken over.
It means the bank has identified information relevant to that customer in the material under investigation.
The precise information involved, its origin and its potential misuse may require further assessment.
Customers should follow official guidance and remain alert to suspicious communication.
Likewise, not receiving a message does not independently establish whether any information associated with a customer appeared somewhere in the larger material.
The notification process reflects the records identified by the bank during its investigation.
Why Personal Data Leaks Can Lead to Banking Phishing
Customer identity details may help attackers conduct targeted social engineering.
Criminals sometimes impersonate banks and claim an account is blocked, a KYC update is overdue or a suspicious transaction needs urgent confirmation.
If the scammer knows a customer’s name or banking relationship, the message can appear more credible.
However, accurate personal information does not prove that a message is authentic.
Victims may be directed to fake banking websites or persuaded to disclose authentication codes.
Security teams should therefore treat customer communication and phishing awareness as important parts of incident response, alongside forensic investigation and technical remediation.
For consumers, the safest approach is to verify the request independently rather than responding directly through the suspicious communication.
What Businesses and Security Teams Can Learn From the SBI Incident
The SBI disclosure highlights the importance of external threat intelligence in discovering suspected data exposure.
The bank says several outside entities alerted it to information reportedly circulating on the dark web.
Organizations handling sensitive financial information should maintain procedures to receive and validate such alerts.
A practical response involves preserving relevant evidence, assessing the authenticity of reported data, identifying potential exposure sources and notifying affected people based on verified findings.
Security teams must also distinguish between the size of an alleged dataset and the number of confirmed affected individuals.
Accurate public communication can reduce unnecessary panic while helping customers understand genuine risks.
Because data investigations can evolve, initial record counts and scope assessments should be treated as preliminary until validated.
Confirmed vs Unknown: SBI October 2026 Data Incident
Confirmed or Disclosed by SBI
- SBI received alerts about suspected data exposure on October 16.
- The bank disclosed the incident to stock exchanges on October 21.
- Its preliminary analysis identified 3,897 customer PII records among approximately 375,000 records reviewed.
- The bank activated cybersecurity response and containment procedures.
- An independent CERT-In-empanelled cybersecurity agency was engaged.
- SBI reported no material impact on core banking operations or business continuity.
- On October 23, SBI said it had individually informed identified customers through email and/or WhatsApp.
- The bank reiterated that account balances and funds remain safe.
Unknown or Not Independently Established
- The complete source of the exposed material.
- The final number of unique individuals affected.
- The complete authenticity and scope of the larger reported dataset.
- Whether attackers accessed SBI’s core banking infrastructure.
- A confirmed exploited software vulnerability or malware family.
- That every claimed banking document in criminal posts is genuine.
- A verified connection between the exposure and unauthorized withdrawals.
- The final results of the independent cybersecurity investigation.
CyberUpdates365 Analysis
SBI’s October 2026 incident highlights two separate responsibilities for financial institutions: investigating suspected exposure and communicating promptly with customers who may be affected.
The bank’s initial stock exchange disclosure established the preliminary nature of the findings.
Its later customer update confirms that the institution moved to individual notifications for customers identified during the assessment.
That distinction is important because a headline about hundreds of thousands of records could easily be mistaken for hundreds of thousands of confirmed compromised bank accounts.
The available evidence supports a narrower finding of 3,897 customer records containing PII in the preliminary review.
The fact that account balances remain safe is reassuring, but personal-data exposure still presents risks.
Contact details and banking-related identifiers can provide context for convincing impersonation attempts.
Therefore, banking incident response should address both the security of financial systems and the downstream misuse of customer information.
Another important lesson concerns detection.
SBI’s disclosure identifies external threat intelligence and national cybersecurity organizations among the sources that alerted it to the suspected exposure.
Organizations should be prepared to validate and act on external intelligence without automatically accepting every criminal claim.
The full technical cause has not been established, making it inappropriate to attribute the incident to a specific zero-day, malware campaign or third-party compromise.
The central lesson is that responsible banking cybersecurity reporting requires separating exposed personal data, confirmed account compromise and speculative criminal claims.
Research Evidence
- Organization: State Bank of India.
- Initial alerts: October 16, 2026.
- Exchange disclosure: October 21, 2026.
- Customer notification update: October 23, 2026.
- Records reviewed: Approximately 375,000.
- Customer PII records identified: 3,897.
- Potentially exposed fields: Customer identity, contact, branch and loan-related identifiers.
- Customer notification channels: Email and/or WhatsApp.
- Account balances: SBI says funds remain safe.
- Core operations: No material impact reported.
- Forensic assessment: Independent CERT-In-empanelled cybersecurity agency.
- Confirmed attack vector: Not disclosed.
Frequently Asked Questions
What happened in the SBI cyber incident?
SBI disclosed suspected customer-data exposure and identified 3,897 records containing PII during a preliminary review of approximately 375,000 dark web records.
Has SBI started notifying affected customers?
Yes. On October 23, SBI said it had individually informed customers whose data was identified through email and/or WhatsApp.
Are SBI account balances and funds safe?
SBI says customers’ balances and funds remain safe and that its core banking operations have not suffered material disruption.
Were 375,000 SBI customers hacked?
That has not been established. The 375,000 figure refers to the approximate number of records reviewed, not confirmed compromised customers.
What personal information was identified?
Reported fields include names, phone numbers, dates of birth, email addresses, residential addresses and selected customer or loan-related identifiers.
Should I trust a WhatsApp message claiming to be from SBI?
Not automatically. Verify unexpected notifications through the bank’s official website, app or trusted contact channels, and never share OTPs, PINs or passwords.
Has SBI confirmed how the data was exposed?
No. The bank engaged independent investigators to assess the information’s authenticity, source and full extent.
What should I do if I notice unauthorized transactions?
Contact SBI immediately through its official fraud-reporting process. In India, financial cyber fraud can also be reported through the national helpline at 1930.
Final Takeaway
State Bank of India has confirmed that it individually notified customers identified in an October 2026 data-exposure investigation through email and/or WhatsApp.
The bank’s preliminary findings identified 3,897 customer PII records among roughly 375,000 records reviewed.
SBI says customer balances remain safe and core banking services continue without material disruption.
Customers should verify unexpected communications, protect authentication information and monitor accounts while the investigation establishes the full scope and origin of the exposure.
The priority is to respond to genuine identity-data risks without confusing the disclosed incident with a confirmed compromise of customers’ bank balances.
Concerned about banking fraud after a personal-data exposure?
Customer information can become a tool for impersonation and financial scams. Our separate investigation explains how criminals have abused financial-technology workflows to test stolen banking credentials.
Read: Open Banking Fraud and Stolen Credential Testing →
