SBI Data Breach 2026: What Happened & Who is Affected?

SBI has confirmed that personal data from almost 3,900 customer records was found on the dark web, but says account balances remain completely safe.

The records are part of a larger dataset of about 3.75 lakh entries that the hacker group “Siriusim” claims to have leaked. SBI has not confirmed that the remaining records belong to its customers.

SBI disclosed the incident to the BSE and NSE on October 21, 2026. This was after alerts from its threat-intelligence provider, the Defence Cyber Agency, and CERT-In on October 16.

Ace your personal finance journey with Entri’s Personal Finance Online Course. Join Now!

Key Takeaways

• SBI found 3,897 customer records with personal data among about 3.75 lakh dark-web records.
• Leaked details may include names, contact details, addresses, and loan identifiers.
• SBI says account balances are safe and operations are unaffected.
• Passwords, PINs, OTPs, and card details are not confirmed as leaked.
• An independent cybersecurity agency is investigating.
• The main risk is targeted phishing using leaked personal details.

SBI Data Breach at a Glance

What Happened in the SBI Data Breach?

On October 16, 2026, SBI received multiple alerts on its customer data being surfaced on the dark web. The bank immediately activated its cyber incident response measures and hired an independent cybersecurity firm empanelled by CERT-In to investigate this.

On the very same day, monitoring account CyberPulse56 flagged a claim on X by a threat actor named “Siriusim”. The group said it held about 3.75 lakh rows of SBI-linked data and 2,722 PDF files. This includes loan applications and account-opening forms. It shared four sample records. The Free Press Journal found that the sample phone numbers were real.

SBI’s October 21 filing confirmed the 3,897 PII records. However, it does not name Siriusim, mention the PDFs or explain how the data left the bank.

Timeline of the SBI Data Leak

3,897 vs 3.75 Lakh: What do the Numbers Mean?

The 3.75 lakh figure is the size of the dataset found online, while 3,897 is the number of records SBI confirmed contain customer PII. Mixing the two up exaggerates the breach.

A record is not the same as a person. One customer can appear in several entries. So the final count of affected people may differ.

Who is Affected by the SBI Data Breach?

Customers whose details are among the 3,897 PII records are the confirmed affected group. SBI says only a “very very small number of customers” are impacted but has not published a list or said whether it will notify them individually.

Because the data includes lead IDs and loan metadata, the leak appears tied to loan and account applications. Reports on the sample data found most entries related to loans, with some linked to savings account applications. If you recently applied for an SBI loan or account, stay extra alert.

What Data was Exposed in the SBI Leak?

A CIF (Customer Information File) number is a unique ID the bank gives each customer. It cannot move money on its own. However, paired with your name and loan details it makes a scam call very convincing.

Is Your SBI Account Safe?

Yes, according to SBI, customer account balances are completely safe. The bank says the incident has no material impact on its IT systems, core operations, financial performance or business continuity.

The real risk falls on social engineering. A fraud caller with your bank details can easily sound like an SBI officer. Understand that knowledge does not prove they are genuine.

How SBI Customers Can Protect Themselves

• Never share OTPs, UPI PINs, passwords, card PINs, or CVV.
• Change your YONO and internet-banking passwords if you notice unusual activity.
• Turn on SMS, email, and app transaction alerts.
• Download YONO SBI only from official app stores.
• Avoid links asking you to update KYC, unlock your account, or prevent closure.
• Treat urgent calls, suspension threats, and unexpected loan or refund offers as red flags.
• Report cyber fraud at cybercrime.gov.in or call 1930.
• Forward phishing messages to report.phishing@sbi.co.in.

Speed matters. Under RBI’s customer liability rules, reporting an unauthorised electronic transaction within three working days can protect you from loss. This is applicable when the fault lies with a third party.

Ace your personal finance journey with Entri’s Personal Finance Online Course. Join Now!

Why the SBI Data Breach Matters

SBI is India’s largest bank, so even a small leak dents customer trust. The breach was flagged by outside agencies after the data was already online, and SBI’s filing reassured investors without saying whether affected customers would be told.

Digital rights group IFF (Internet Freedom Foundation) has urged SBI to

• Notify affected customers by SMS, email and letter.
• Set up a helpline and a data-check tool.
• Confirm compensation for losses.

It notes that the breach-notification duty in Section 8(6) of the Digital Personal Data Protection (DPDP) Act, 2023 is not yet in force. It has also asked the RBI to make banks alert customers within a fixed time.

The danger now lies in scam calls and messages. The leaked details at the wrong hands will be used to contact the customers to sound genuine. So make sure you verify every request through official channels before taking any actions.