Last updated: 23 October 2026. Based on SBI’s stock-exchange filing of 21 October and reporting by Business Standard and The Hacker News. The investigation is ongoing; we will update this page if SBI shares more.
On 21 October 2026, State Bank of India (SBI), India’s largest bank, told the stock exchanges about a suspected exposure of customer data on the dark web. If you bank with SBI, you do not need to panic, but you should expect more convincing scam calls and messages over the coming weeks. This guide explains what was exposed, what was not, and the simple steps that keep your money safe.
What SBI has said
- On 16 October, SBI was alerted by its threat-intelligence provider, CERT-In and the Defence Cyber Agency.
- A preliminary review of about 375,000 records found on the dark web identified 3,897 customer records containing personal information. SBI has not said how many individual customers this represents.
- SBI activated its incident response, engaged an independent CERT-In-empanelled cybersecurity firm, and says the authenticity, source and extent of the data are still being investigated.
- SBI says there is no material impact on its operations. It has not said whether a bank system was breached or how the data was obtained, and it has not announced customer notifications.
What data was exposed (and what was not)
| Reported as exposed | Not listed in SBI’s disclosure |
|---|---|
| Name, gender, date of birth | Account numbers and balances |
| Registered mobile number and email address | Internet banking / YONO passwords |
| Residential address | OTPs, PINs, card numbers or CVVs |
| Branch and CIF (customer) identifiers | PAN and Aadhaar numbers |
| Lead IDs and loan / lead record details |
This information cannot be used on its own to take money from your account. The danger is that it makes scams far more believable: a caller who knows your name, date of birth, branch and that you recently enquired about a loan sounds very much like the bank.
Scams to expect
- Fake “SBI security team” calls saying your account is blocked or compromised and asking you to “verify” with an OTP.
- Loan offer scams that mention your real loan enquiry and ask for a “processing fee” or app installation.
- KYC update SMS or WhatsApp messages with a link to a fake YONO or net banking page.
- Remote-access requests asking you to install a screen-sharing app “to fix a problem”.
- UPI collect requests disguised as refunds: entering your UPI PIN sends money, it never receives it.
- “Data breach compensation” or “digital arrest” calls that use your details to frighten you into paying.
8 steps to protect yourself
- Never share an OTP, PIN, CVV, UPI PIN or password with anyone, including someone who says they are from SBI, the RBI or the police. Banks never ask for these.
- Hang up and call back using the number on the official website (sbi.co.in), the back of your card or the YONO app, never a number given by the caller or in a message.
- Do not click links in SMS, email or WhatsApp messages about your account. Type the address or use the official app.
- Never install screen-sharing or remote-access apps because a caller asks you to.
- Turn on SMS and email alerts for every transaction, and check your statement regularly.
- Lower your online and card limits in YONO or net banking if you do not need high limits, and switch off international or online card use when not in use.
- Use a strong, unique password for net banking and your email, and enable every extra security option the bank offers.
- Warn family members, especially elderly parents, who are often targeted by these calls.
Where to report
| Situation | Report to |
|---|---|
| Phishing email, SMS or fake SBI website | report.phishing@sbi.co.in |
| Suspected fraud call, SMS or WhatsApp message (no money lost) | Chakshu on the Department of Telecommunications’ Sanchar Saathi portal (sancharsaathi.gov.in) or app |
| You have lost money | Call 1930 immediately (National Cyber Crime Helpline), then file a complaint at cybercrime.gov.in and inform your branch |
Speed matters if money is taken: reporting within the first few hours gives the best chance of freezing the funds before they move on.
Frequently asked questions
Was my SBI account hacked?
SBI has not reported any access to accounts, passwords or card data. The exposed information is personal and contact data. Your account is safe as long as you do not share OTPs, PINs or passwords.
How do I know if my data is in the leak?
SBI has not published a way to check, and you should not search for or download leaked data. Assume your details could be known to scammers and follow the steps above.
Should I close my SBI account or change my mobile number?
No. That is not necessary. Change your net banking password if you like, keep alerts on, and stay alert to scams.
What does this mean for businesses?
Lead and loan data often moves through CRMs, marketing agencies and other vendors. Under India’s Digital Personal Data Protection (DPDP) Act, organisations are responsible for protecting personal data, including data handled by their processors. Review who holds your customer data, how it is protected and how quickly you would detect a leak. Our ISO 27001 readiness assessment covers supplier and data-protection controls.
The SBI leak was one of many incidents in a busy week; read our “Black October” fact-check for the full picture.
