New Delhi: The State Bank of India (SBI) has informed stock exchanges on Wednesday (October 21) that some of its customer data has surfaced on the dark web. The filing came five days after the bank was alerted by its threat intelligence providers, the Defence Cyber Agency and CERT-In.In its disclosure under market regulator Sebi’s norms, the bank said that it had so far gone through roughly 3,75,000 records available online and found personally identifiable information in 3,897 of them.“During the preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified,” SBI told the exchanges.According to the bank, the leaked details include registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses. Branch and Customer Information File (CIF) identifiers, lead IDs and metadata linked to loan or lead records and other files were also part of the exposure.SBI said a detailed investigation is needed to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure and assess the associated risks to customers and the bank itself. It has switched on its cyber incident response and containment protocols, and has hired an independent cybersecurity firm empanelled with CERT-In to examine the nature and extent of the alleged compromise.The lender maintained that its core operations, financial performance and business continuity have not been materially affected, and that its main functions are running without disruption.“A detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required,” the bank said.“We reassure that the bank continues to monitor the situation closely and take all appropriate measures in accordance with applicable regulatory requirements,” it added.Digital rights group questions the responseThe Internet Freedom Foundation (IFF), in a statement released the same day, said SBI addressed the claim only after the information was already public. The statement said:“The leak was public before SBI said anything about it. On October 16, the cyber security monitoring account CyberPulse56 posted on X that a threat actor calling itself ‘Siriusim’ claimed to have released 3.75 lakh rows of data in CSV format and 2,722 PDF documents linked to SBI.“The dataset was said to include personal customer information, loan applications, supporting documents and account opening applications. On October 19, India Today Tech reported that SBI had not addressed the claim. The bank’s filing came two days later.“SBI is not alone. In July 2026, Bank of Baroda began a forensic investigation after a compromised employee email account allowed unauthorised access to its data.”The digital rights group pointed out that while the SBI has informed the exchanges, a customer notice, a press release or an advisory from the bank informing the 3,897 customers isn’t available publicly despite the Reserve Bank of India (RBI)’s own advisory of March 2026 recommending that banks notify affected customers.“If SBI has written to these customers, it should say so publicly. If it has not, it should do so today,” the IFF wrote. It added:This matters because of how banking fraud works in India. A caller who knows your name, date of birth, branch, CIF number and the loan you applied for will sound like an official of your bank. The standard advice never to share an OTP assumes that a customer can tell a fraudster apart from the bank. Leaked data erodes that ability, and only notice from the bank lets the customer know to be on guard.The IFF underlined that Section 8(6) of the Digital Personal Data Protection Act, 2023 requires a data fiduciary to inform the Data Protection Board and each affected data principal of a personal data breach.“Rule 7 of the DPDP Rules, 2025 sets out how, parliament passed the Act in August 2023, but under the staggered commencement notified by the Union government, these provisions take effect only in May 2027. In January 2026, MeitY floated a proposal to shorten this window, but no amendment has been notified,” it said.“Until then, the obligations in force run to regulators. The CERT-In Directions of 28 April 2022 require reporting of incidents to CERT-In within six hours. The RBI’s cyber security framework for banks requires an initial report to the RBI within two to six hours. A bank can comply with every one of these and still leave its customers in the dark,” it said.Further, the IFF noted that a public sector bank is also bound by the right to informational privacy recognised by the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). Therefore, informing people that their data has been exposed is the least that right requires, it mentioned.The IFF said that it has sent a representation to the chairman of SBI, marking copies to the governor of the Reserve Bank of India (RBI) and the director general of CERT-In.The digital rights group has asked the bank to take six measures:Inform every affected customer directly, by SMS, email and letter, in English, Hindi and the language of their home branch, explaining what data was exposed and what they should do.Set up a helpline and an online facility for customers to check whether their data is part of the exposed set.State what the 3.75 lakh records and 2,722 documents contain, how many customers they concern and whether they include Aadhaar, PAN or passport copies.Disclose how the data left the bank once the investigation concludes, including whether a vendor or direct selling agent was involved, and publish a summary of the investigating agency’s findings.Confirm that customers who lose money because of this breach will be compensated under the RBI’s rules on limiting customer liability.Say whether it has followed the RBI’s Advisory No. 3/2026, and if not, why.SBI told the stock exchanges about its data breach. Customers? Not a word.Purrjury breaks down what was leaked, why it’s a scammer’s dream, and what IFF is demanding. Swipe to read.#DataBreach #SBI #DPDP #DigitalRights #IFF https://t.co/vi1uRwqTBE— Internet Freedom Foundation (IFF) (@internetfreedom) October 21, 2026‘SBI didn’t even detect the breach itself’Congress Rajya Sabha MP Pawan Khera said that what makes matters worse is the fact that “SBI did not even detect the breach itself”.“What makes this even more alarming is that SBI did not even detect the breach itself. An external agency had to alert the bank that its customers’ data had already been published on the dark web,” Khera wrote on X.He added, “Now adding insult to injury, SBI is yet to inform the very customers whose personal information it has failed to protect. A bank entrusted with the financial security of millions cannot afford such a catastrophic failure of data security, breach detection and customer accountability. SBI owes its customers answers. Those responsible must be held accountable.”❌It is bad enough that the State Bank of India @TheOfficialSBI, the country’s largest public sector bank, has suffered a data breach involving 3.75 lakh rows of data, with 3,897 records containing personally identifiable customer information – including mobile numbers, dates of birth, names, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and loan-related details.❌What makes this even more alarming is that SBI did not even detect the breach itself. An external agency had to alert the bank that its customers’ data had already been published on the dark web.❌Now adding insult to injury, SBI is yet to inform the very customers whose personal information it has failed to protect.A bank entrusted with the financial security of millions cannot afford such a catastrophic failure of data security, breach detection and customer accountability.SBI owes its customers answers. Those responsible must be held accountable.— Pawan Khera 🇮🇳 ಪವನ್ ಖೇರಾ (@Pawankhera) October 21, 2026