Nearly four thousand customers of the State Bank of India have had their names, phone numbers, dates of birth and loan details surface on the dark web, yet the bank's only public word on the matter has gone to stock exchanges rather than to the people whose data was exposed. The disclosure, filed on 21 October 2026, satisfies securities law. It does not, by itself, tell a single affected customer that their information is circulating where fraudsters can find it.
What the Filing Says, and What It Leaves Out
SBI's Regulation 30 filing to the BSE and NSE describes an "Incident involving Data Loss" first flagged on 16 October through its threat intelligence vendor, the Defence Cyber Agency and CERT-In. A preliminary review of roughly 3.75 lakh records found on the dark web identified 3,897 customer records containing personally identifiable information, including mobile numbers, dates of birth, addresses, CIF identifiers and loan details. The bank says it cannot yet confirm the data's authenticity or full extent, and that an independent CERT-In empanelled agency has been engaged to investigate. Crucially, the filing states there is no material impact on SBI's core business, but says nothing about the 2,722 PDF documents a threat actor calling itself "Siriusim" had already claimed, days earlier, to have released alongside the CSV data. Loan and account-opening files typically carry copies of identity and address proof, which means the true number of people affected could run well beyond the 3,897 figure the bank has confirmed.
A Gap Between Regulatory Duty and Customer Right
Indian law currently obliges breach reporting to regulators, not to customers. CERT-In's 2022 directions require notification within six hours; the RBI's cyber security framework for banks sets a similarly tight window. Section 8(6) of the Digital Personal Data Protection Act, 2023, which would compel banks to inform each affected individual, will not take effect until May 2027, under the government's staggered commencement schedule. That leaves a wide window in which a bank can meet every regulatory deadline that matters to authorities while telling depositors nothing. The RBI tried to narrow that gap on its own terms: its March 2026 advisory on customer data protection explicitly recommends that supervised entities notify affected customers through SMS, email, app alerts and calls, with helpline support built into incident response plans. The advisory carries no binding force, and SBI's filing gives no indication that this standard has been met.
Why Silence Carries Its Own Risk
Banking fraud in India increasingly relies on impersonation rather than brute-force hacking. A caller who already knows a customer's name, date of birth, branch and loan particulars sounds credible precisely because those details are supposed to be known only to the bank. The usual warning never to share an OTP assumes customers can distinguish a genuine bank official from a fraudster; a leak like this erodes that distinction at its root. Only a direct notice from SBI allows the affected customers to recognise manipulation attempts built on their own stolen details. The bank is not alone in facing such an incident; Bank of Baroda opened a similar forensic investigation in July 2026 after a compromised employee email account allowed unauthorised access to its systems, suggesting a wider pattern of exposure across Indian lenders rather than an isolated failure.
What Should Happen Next
- Direct notification to every affected customer, in English, Hindi and the local language of their home branch
- A dedicated helpline and online tool to check individual exposure
- Full disclosure of what the 3.75 lakh records and 2,722 documents contain, including whether Aadhaar, PAN or passport copies are involved
- A public account of how the data left the bank once the investigation concludes
- Assurance that customers who suffer financial loss will be compensated under RBI's limited-liability rules
Until such steps are taken, and until Parliament's own breach-notification law actually comes into force, customers are left to rely on vigilance rather than information. Anyone banking with SBI should treat unsolicited calls, messages or emails referencing personal or loan details with suspicion, remembering that SBI never asks for OTPs, passwords or PINs, and should report anything unusual to the bank's helpline or to the national cyber crime helpline at 1930.