State Bank of India has disclosed a cybersecurity incident under SEBI (LODR) Regulations, 2015, involving suspected exposure of customer data on the dark web. On October 16, 2026, SBI received alerts from its Threat Intelligence Service Provider, Defence Cyber Agency, and CERT‑In about the issue. Preliminary analysis found around 3.75 lakh records available online, including 3,897 customer records containing Personally Identifiable Information such as names, mobile numbers, email addresses, birth dates, and residential details.
The bank immediately activated its cyber incident response and containment protocols. An independent CERT‑In‑empanelled cybersecurity agency was engaged to conduct a detailed investigation into the authenticity, source, and extent of the exposure. SBI clarified that the alleged data leak has no material impact on its core business operations, financial performance, or continuity.
The bank assured that its systems continue to function normally and that remedial and preventive measures are being implemented. SBI reaffirmed its commitment to monitor the situation closely and comply with all regulatory requirements while safeguarding customer information.
