The State Bank of India (SBI), the country’s largest lender, has initiated a cybersecurity investigation following the suspected exposure of customer information on the dark web. A preliminary examination of approximately 3.75 lakh records identified 3,897 customer records containing personally identifiable information (PII), raising concerns over data protection, cyber risk management and customer confidentiality.
According to the bank’s regulatory disclosure dated 21 October 2026, SBI received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). The alerts indicated that certain customer-related information may have been exposed on unauthorised online platforms.
The information identified during the preliminary assessment reportedly included customer names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch identifiers, Customer Information File (CIF) numbers, lead IDs and metadata associated with loan-related records.
Following the alerts, SBI activated its cyber incident response and containment protocols. The bank also appointed an independent CERT-In-empanelled cybersecurity agency to undertake a comprehensive forensic assessment, verify the authenticity of the exposed information, identify its possible source and determine the extent of the suspected compromise.
SBI clarified that the incident had not materially affected its core banking operations, financial performance or business continuity. Banking services continued to function normally, while the institution undertook further investigations and implemented appropriate preventive and remedial measures.
The incident highlights an increasingly important challenge for financial institutions: protecting sensitive customer information across interconnected digital ecosystems involving technology vendors, outsourcing partners and external service providers. Although the source of the suspected exposure remains under investigation, such incidents underscore the importance of third-party risk assessments, continuous threat intelligence, data access controls and effective cyber incident response frameworks.
Beyond immediate operational concerns, exposure of customer information may increase the risk of phishing, identity impersonation, social engineering and targeted financial fraud. Consequently, banks must address not only the technical consequences of suspected data breaches but also the potential implications for customer confidence, regulatory compliance and institutional reputation.
RMAI Risk Perspective: The SBI incident reinforces the importance of integrating data security, third-party risk management, cyber incident response and reputation risk within enterprise risk management frameworks. Financial institutions should assess whether their existing controls provide sufficient visibility over customer data held by external partners and whether their incident response strategies adequately address customer communication, forensic investigation and long-term confidence restoration.
