SBI Data Leak, October 2026: What Was Reported and What Customers Should Do

State Bank of India disclosed a suspected data leak to the stock exchanges on October 21, 2026, in a SEBI-mandated filing. Indian outlets including The Tribune and Business Standard carried the same core facts.

A preliminary review found personal information in 3,897 customer records. Those records sat among roughly 3.75 lakh (about 375,000) records described as available on the dark web. The seller's own claim is larger, about 3.8 lakh rows plus documents, and SBI has not confirmed the dataset's authenticity or completeness. SBI listed the exposed fields as names, gender, registered mobile numbers, dates of birth, email and residential addresses, branch details, Customer Information File (CIF) identifiers, lead identification numbers, and information from loan-related records.

SBI reported no material impact on core operations, financial performance or operational continuity, and said critical services continued. Its filing did not specify which systems were involved. It activated its cyber incident response procedures and engaged an independent agency empanelled with CERT-In to verify the data's authenticity and completeness and to trace the source.

SBI did not find this itself. Alerts arrived on October 16, 2026 from three outside parties: the bank's threat intelligence service provider, the Indian Computer Emergency Response Team (CERT-In), and the Defence Cyber Agency, as reported in Indian press coverage of the filing. Public disclosure followed five days later.

That gap is not unusual for a listed company that has to establish facts before filing. It is still the window in which the data was reportedly circulating and customers had not been told anything.

A group calling itself Siriusim claimed to hold SBI customer data, a claim first flagged by a monitoring account on X and relayed in Indian press coverage. Nobody has shown that independent researchers examined the dataset. The claim, surfaced by a monitoring account on X, described about 3.75 lakh CSV rows and 2,722 PDF files, including loan applications and account-opening documents.

None of that has been confirmed. SBI's filing speaks only to the 3,897 records with personal data. Whether the PDFs exist, and whether they contain KYC or Aadhaar documents, is the question SBI's filing does not answer.

The source of the data has not been established. SBI has not said whether the 3,897 records map to 3,897 distinct people, what the remaining rows contain, or whether affected customers have been contacted. The IFF said the bank had not addressed whether customers were informed, and asked whether a vendor or a direct selling agent was involved.

Treat any explanation of how the data left the bank as speculation until the investigation reports.

The field list is the most useful public evidence, and it is worth reading the way an incident responder would.

Lead IDs and loan-record metadata are not core banking data. They belong to the lead and loan origination pipeline: the systems that track a prospect from first enquiry to sanctioned loan. In most banks that pipeline is touched by far more parties than the ledger is. Branch staff, call centres, marketing platforms, CRM vendors, and external sales agents all handle lead records, and they often handle them in spreadsheets and exports.

That is an inference from the fields, not a finding. It does explain why SBI could say balances were safe and still have a serious exposure. A leaked lead record does not move money. It gives a fraudster a script.

The realistic risk is not someone logging into your account with this data. It is someone calling you who already knows your name, birth date, branch, and that you applied for a loan, and who uses that to get the one thing they do not have: an OTP, a PIN, or remote access to your phone.

Assume the next bank call could be fake

Watch for loan-themed lures

Turn on alerts and check your credit report

Report fraud quickly

Three things generalise beyond SBI.

First, lead data needs the same controls as customer data. Lead pipelines grow by integration and export, and the access list rarely gets reviewed. Inventory every place lead records are copied, including agent and vendor systems, and cut fields that a sales workflow does not need.

Second, plan for outside detection. Here the first signal came from a threat intelligence provider and two government agencies. Your incident process should start cleanly from an external tip, with a named owner, a way to sample and verify the dataset, and a clock running from the tip, not from internal confirmation.

Third, the customer-facing response is the containment step. When the exposed data is a fraud script, the bank's call centre, SMS templates, and outbound verification habits decide how much damage follows. Publish how the bank will and will not contact customers, and brief front-line staff before the filing goes out.

NewsGram noted that SBI could face scrutiny under the Digital Personal Data Protection Act, 2023. The IFF called on MeitY to bring into force Section 8(6) of the Act and Rule 7 of the DPDP Rules, which cover breach intimation to affected individuals, and asked the RBI to direct regulated entities to inform customers. How regulators respond is not yet known.