Last updated: 23 October 2026. Based on SBI’s stock-exchange filing of 21 October and reporting by Business Standard and The Hacker News. The investigation is ongoing; we will update this page if SBI shares more.
On 21 October 2026, State Bank of India (SBI), India’s largest bank, told the stock exchanges about a suspected exposure of customer data on the dark web. If you bank with SBI, you do not need to panic, but you should expect more convincing scam calls and messages over the coming weeks. This guide explains what the leak exposed, what it did not, and the simple steps that keep your money safe.
What SBI has said
- On 16 October, SBI’s threat-intelligence provider, CERT-In and the Defence Cyber Agency alerted the bank.
- A preliminary review of about 375,000 records found on the dark web identified 3,897 customer records containing personal information. SBI has not said how many individual customers this represents.
- SBI activated its incident response and engaged an independent CERT-In-empanelled cybersecurity firm. It says it is still investigating the authenticity, source and extent of the data.
- SBI says there is no material impact on its operations. However, it has not said whether attackers breached a bank system or how they obtained the data, and it has not announced customer notifications.
What data the leak exposed (and what it did not)
| Reported as exposed | Not listed in SBI’s disclosure |
|---|---|
| Name, gender, date of birth | Account numbers and balances |
| Registered mobile number and email address | Internet banking / YONO passwords |
| Residential address | OTPs, PINs, card numbers or CVVs |
| Branch and CIF (customer) identifiers | PAN and Aadhaar numbers |
| Lead IDs and loan / lead record details |
On its own, nobody can use this information to take money from your account. The danger is that it makes scams far more believable: a caller who knows your name, date of birth, branch and that you recently enquired about a loan sounds very much like the bank.
Scams to expect
- Fake “SBI security team” calls saying your account is blocked or compromised and asking you to “verify” with an OTP.
- Loan offer scams that mention your real loan enquiry and ask for a “processing fee” or app installation.
- KYC update SMS or WhatsApp messages with a link to a fake YONO or net banking page.
- Remote-access requests asking you to install a screen-sharing app “to fix a problem”.
- UPI collect requests disguised as refunds: entering your UPI PIN sends money, it never receives it.
- “Data breach compensation” or “digital arrest” calls that use your details to frighten you into paying.
8 steps to protect yourself
- Never share an OTP, PIN, CVV, UPI PIN or password with anyone, including someone who says they are from SBI, the RBI or the police. Banks never ask for these.
- Hang up and call back using the number on the official website (sbi.co.in), the back of your card or the YONO app, never a number given by the caller or in a message.
- Do not click links in SMS, email or WhatsApp messages about your account. Type the address or use the official app.
- Never install screen-sharing or remote-access apps because a caller asks you to.
- Turn on SMS and email alerts for every transaction, and check your statement regularly.
- Lower your online and card limits in YONO or net banking if you do not need high limits, and switch off international or online card use when not in use.
- Use a strong, unique password for net banking and your email, and enable every extra security option the bank offers.
- Warn family members, especially elderly parents, who are often targeted by these calls.
Where to report
| Situation | Report to |
|---|---|
| Phishing email, SMS or fake SBI website | report.phishing@sbi.co.in |
| Suspected fraud call, SMS or WhatsApp message (no money lost) | Chakshu on the Department of Telecommunications’ Sanchar Saathi portal (sancharsaathi.gov.in) or app |
| You have lost money | Call 1930 immediately (National Cyber Crime Helpline), then file a complaint at cybercrime.gov.in and inform your branch |
Speed matters if you lose money: reporting within the first few hours gives the best chance of freezing the funds before they move on.
Frequently asked questions
Did someone hack my SBI account?
SBI has not reported any access to accounts, passwords or card data. The exposed information is personal and contact data. Your account is safe as long as you do not share OTPs, PINs or passwords.
How do I know if my data is in the leak?
SBI has not published a way to check, and you should not search for or download leaked data. Instead, assume scammers may know your details and follow the steps above.
Should I close my SBI account or change my mobile number?
No. That is not necessary. Change your net banking password if you like, keep alerts on, and stay alert to scams.
What does this mean for businesses?
Lead and loan data often moves through CRMs, marketing agencies and other vendors. Under India’s Digital Personal Data Protection (DPDP) Act, organisations are responsible for protecting personal data, including data handled by their processors. Therefore, review who holds your customer data, how you protect it and how quickly you would detect a leak. Our ISO 27001 readiness assessment covers supplier and data-protection controls.
The SBI leak was one of many incidents in a busy week, so read our “Black October” fact-check for the full picture.
