State Bank of India has disclosed a cybersecurity incident involving 3,897 customer records containing personal information, after data was identified on the dark web. The bank has appointed an independent cybersecurity investigator to establish the authenticity, source and extent of the exposed information, according to its disclosure reported by The Financial Express.
What data was involved?
According to The Financial Express, reporting the bank’s disclosure, affected records included personally identifiable information such as names, contact details, birth dates, addresses and certain loan-related records. The precise impact on each affected individual may differ.
What has SBI said?
SBI said the incident was not expected to materially disrupt its operations or financial performance. That statement concerns business continuity. It does not establish that exposed personal information carries no phishing or identity-fraud risk. The investigation is intended to assess risks to customers as well as the bank.
What should customers do?
Use only official SBI channels to check account notifications, monitor transactions, enable available account alerts and avoid sharing OTPs, PINs or passwords with callers or message senders. Suspicious contacts claiming to be from the bank should be verified independently.
Sources: The Financial Express, October 21, 2026; Internet Freedom Foundation, October 21, 2026.
Read more technology and cybersecurity coverage from GulfInside.
Featured image credit: Photo: Ganesh Dhamodkar/Wikimedia Commons, CC BY-SA 4.0. File photo, July 2017; the branch is not identified as the source of the data exposure.
