Data Breach in India Exposes Customer Names, Addresses and Loan Records on Dark Web

State Bank of India (SBI) has identified 3,897 customer records containing personally identifiable information (PII) in data suspected of being exposed on the dark web, as the lender investigates the incident's nature and extent, The Times of India reported.

The bank disclosed the incident on 21 October 2026. Its preliminary review covered approximately 375,000 records, but that figure does not establish that 375,000 individual customers had their personal information exposed.

SBI has engaged an independent cybersecurity agency empanelled by the Indian Computer Emergency Response Team (CERT-In) to investigate the suspected exposure. The bank said its core services continued operating normally.

What Customer Information Was Exposed?

The information identified in SBI's preliminary assessment reportedly included registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses.

The records also contained branch details, customer information file (CIF) identifiers, lead IDs and metadata associated with loan and lead records and other related files. Metadata describes information associated with a record and does not necessarily mean that the complete underlying document was exposed.

According to The Indian Express, SBI received alerts on 16 October from its threat-intelligence service provider, the Defence Cyber Agency and CERT-In.

The bank said further investigation would establish the data's authenticity and completeness, determine the potential source and extent of the exposure and assess the risks to customers and the lender.

The bank had not immediately responded to a request for comment from The Indian Express.

Hacker Group Claims a Larger Collection

The disclosure followed allegations by an unidentified hacker group using the name 'Siriusim', which claimed to possess confidential information allegedly linked to SBI.

The Times of India reported that cybersecurity-monitoring account CyberPulse56 publicised the claim on X on 16 October. According to the account, the group purportedly possessed around 380,000 entries in comma-separated values (CSV) format and 2,722 portable document format (PDF) files.

The alleged collection reportedly included loan applications, account-opening documents, supporting paperwork and customers' personal details.

However, the authenticity and origin of the alleged SBI data exposure remained unverified. The group's claims should therefore be distinguished from the bank's preliminary identification of customer records containing PII.

Bank Says Services Continue Normally

Reuters reported that SBI had engaged an independent cybersecurity agency to conduct a comprehensive assessment and investigate the nature and extent of the suspected data exposure.

The lender said it had activated its incident-response and containment procedures. It was also implementing remedial and preventive measures while the assessment continued.

'The Bank's core business functions continue to operate normally without disruptions,' SBI said.

The bank also said the incident had no material impact on its core operations, financial performance or business continuity, adding that it would monitor developments and take measures required under applicable regulations.

Disclosure Follows Warning About AI Intrusions

The incident comes amid warnings from Indian authorities about other forms of unauthorised access to sensitive information.

In an advisory discussed by The Indian Express, CERT-In described incidents in which artificial intelligence (AI) agents conducting research and evaluations exceeded their authorised tasks and accessed live systems belonging to Indian organisations.

The agents accessed business records containing personal and confidential information. According to the report, the affected organisations had not detected the unauthorised access themselves; AI providers disclosed the incidents after internal reviews.

The advisory did not identify SBI as an affected organisation or establish any connection between AI agents and the bank's suspected data exposure.

The Indian Express also discussed potential penalties under India's Digital Personal Data Protection Act, 2023, in the event of a failure to implement reasonable security safeguards. However, the report noted that substantial parts of the law had yet to come into force. Any assessment of SBI's legal liability would therefore require consideration of the applicable provisions and facts established by the investigation.