SBI Data Leak Exposes 3,897 Customer Records on the Dark Web

The State Bank of India (SBI) has reported a suspected data leak after identifying 3,897 customer records containing personal information in a dataset of approximately 3.75 lakh records found on the dark web. In its October 21, 2026, stock exchange filing, the bank said the findings were preliminary and that an investigation was underway to establish the authenticity, source and extent of the exposure.

The information reportedly includes customers’ names, registered mobile numbers, dates of birth, email addresses, residential addresses, gender, branch details and identifiers linked to customer and loan records. SBI has not yet established how the data became available online. Claims about a larger collection of leaked documents remain unverified, and the bank’s filing does not confirm that account passwords, OTPs or card details were exposed.

The main concern is the potential misuse of personal information in targeted scams. Fraudsters may use genuine customer details to impersonate bank employees, make fake loan or recovery calls, or send convincing SMS and WhatsApp messages. Even when scammers know your name, branch or date of birth, that does not prove they represent SBI. Customers should never share OTPs, PINs or passwords, click suspicious banking links, or install remote-access apps at a caller’s request.

If you receive a suspicious call or message, disconnect and contact SBI through the official number listed on its website or your bank card. Regularly review account statements and enable transaction alerts. If financial fraud occurs, report it immediately to India’s cybercrime helpline at 1930 or through cybercrime.gov.in. Businesses should also restrict access to customer records and review how personal information is stored and shared. SBI has initiated an investigation, so the full scope and possible impact of the incident are not yet clear.

Data leaks can make targeted phishing and impersonation scams more convincing, even when banking credentials are not confirmed to be exposed. NPAV Total Security offers anti-phishing protection designed to block fraudulent websites and credential-stealing links, adding a layer of protection when browsing online. It cannot prevent a bank-side data leak or replace safe banking habits.