SBI Dark Web Data Leak: Incident Overview, Exposed Data, and Security Measures

SBI Dark Web Data Leak: What You Need to Know

1. What Happened?

• Hacker Claim: A threat actor operating under the name "Siriusim" claimed on BreachForums to have accessed around 3.75 lakh (375,000) customer records and 2,722 PDF documents linked to SBI and its subsidiaries.

• Alert & Filing: On October 16, 2026, alerts were raised by threat intelligence providers, the Defence Cyber Agency, and CERT-In. SBI subsequently filed an official disclosure with the stock exchanges on October 21, 2026.

• Preliminary Review: Upon analyzing the 3.75 lakh records circulating on the dark web, SBI confirmed that 3,897 customer records contained verified Personally Identifiable Information (PII).

2. What Data Was Exposed?

The compromised data primarily originates from loan applications and lead records. Exposed details include:

• Personal & Contact Details: Full names, gender, dates of birth, registered mobile numbers, email addresses, and residential addresses.

• Banking Metadata: Customer Information File (CIF) identifiers, branch details, lead IDs, and loan application metadata/documents.

• Uncompromised Data: No passwords, PINs, OTPs, or core banking credentials were leaked.

3. Current Status & Official Response

• Account Balances Are Safe: SBI clarified that no customer account balances or funds were lost or affected. The bank's core banking system and regular day-to-day operations continue to run normally.

• Containment & Investigation: SBI activated its cyber incident response protocols and appointed an independent, CERT-In-empanelled cybersecurity firm to conduct a forensic investigation to identify the exact source of the leak.

• Customer Notifications: SBI has started notifying the affected customers directly to keep them alert regarding potential phishing or fraudulent activities.

4. Safety Guidelines for Account Holders

Since exposed personal and loan details could be used by scamsters to stage convincing phishing attacks, customers should keep the following precautions in mind:

1. Never Share Credentials: SBI staff will never ask for your OTP, passwords, Banking PINs, or UPI PINs over a phone call, SMS, or email.

2. Beware of Suspicious Calls: Be cautious of callers claiming to be loan officers or bank representatives asking to verify loan applications or personal details.

3. Avoid Clicking Unverified Links: Do not open suspicious links sent via email or WhatsApp pretending to be official SBI updates.