SBI data leak: This is what India's largest public sector bank told customers as 3,897 records flagged in cyber incident

SBI notified selected customers that their information had been identified as involved in a suspected cyber incident. The bank sent these notifications by email and/or WhatsApp. This matters because customers need to recognise possible scam attempts and take extra care with digital banking.

The notification followed SBI’s identification of records reportedly found on the dark web. The flagged information could include names, mobile numbers, dates of birth, email addresses, residential addresses, and banking-related identification details. SBI said identifying personal information does not by itself prove that accounts or funds were accessed.

SBI has repeated that customer balances and funds are safe. It is investigating the authenticity, source, extent and risks of the possible exposure with an independent cybersecurity agency empanelled with CERT-In. Customers should verify that any SBI notification is genuine and report suspicious communication or unauthorised transactions through official channels.

A data leak is the suspected exposure or unauthorised availability of information held by an organisation. It can involve personal details without involving direct access to a person’s bank account. This distinction matters because leaked information can create risks, but it does not automatically show that money was touched.

In SBI’s case, records reportedly found on the dark web included names, contact details, dates of birth, addresses and customer or branch identification details. SBI said that finding personally identifiable information in those records does not, by itself, establish that customers’ accounts or funds were accessed or compromised.

The bank’s current position is that account balances and funds remain safe. However, SBI is still investigating the records’ authenticity, possible source, extent and associated risks. Customers should remain alert because exposed details may be used in suspicious calls, messages or emails seeking additional banking information.

SBI examined around 3.75 lakh records during a preliminary review of the suspected exposure. Within that larger set, 3,897 records were identified as containing personally identifiable information. These figures show the difference between the total records reviewed and the records that raised a specific privacy concern.

The examination began after SBI received alerts about a possible exposure. The bank’s filing said the flagged information reportedly included customer identity and contact details, along with branch, customer identification, loan and lead-record metadata. The figures describe the preliminary review, not a final confirmation of every exposed record.

SBI’s investigation is still underway. An independent cybersecurity agency empanelled with CERT-In is examining whether the information is authentic, how much may have been exposed, where it may have come from and what risks could follow. The bank has said there is no material impact on operations or finances.

The flagged records reportedly contained several types of personal and banking-related information. These included customers’ names, registered mobile numbers, dates of birth, email IDs and residential addresses. Such details can identify or contact customers, which is why their possible exposure matters.

The records also reportedly contained branch and customer identification details. In addition, they included metadata associated with loan and lead records. SBI identified 3,897 records containing personally identifiable information during a preliminary examination of around 3.75 lakh records.

The presence of these details does not prove that customer accounts or funds were accessed. SBI has reassured customers that their balances and funds are safe, while an independent cybersecurity agency investigates the authenticity and extent of the information. Customers should still be cautious with unexpected calls, messages and emails requesting personal or financial information.

SBI received alerts about the suspected exposure on October 16. The alerts came from its threat-intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, known as CERT-In. These warnings prompted the bank to activate its cyber incident response and containment protocols.

SBI then appointed an independent cybersecurity agency empanelled with CERT-In. The investigation is examining whether the records and information are authentic, how much information may have been exposed and the possible source of the exposure. It is also assessing the risks associated with the incident.

The investigation has not yet established the full extent or implications of the suspected exposure. SBI has said the incident has had no material impact on core operations, financial performance or business continuity. The bank continues to tell customers that their account balances and funds are safe while the review proceeds.

Leaked contact and identity details can make scams more convincing. A fraudster could use a customer’s name, phone number, email address or other known details while pretending to represent SBI. The customer might then face phishing messages, impersonation attempts or calls requesting more sensitive information.

The key danger is that exposed details alone do not necessarily provide account access. A scammer may try to persuade a customer to reveal an OTP, PIN or password, or to respond to a suspicious link or message. SBI specifically warned customers against sharing these credentials and against requests for personal or financial information.

SBI says account balances and funds are safe, but the investigation remains incomplete. Customers should verify notifications, avoid unexpected links, and report suspicious communications or unauthorised transactions through official bank channels. The bank is still assessing the possible risks linked to the suspected exposure.

OTPs, PINs and passwords are authentication details used to verify a digital-banking user. An OTP provides a temporary confirmation, while a PIN or password is a secret chosen or assigned for access. Together, these checks help distinguish an authorised customer from someone merely claiming to be that customer.

Their protection depends on secrecy. If a customer gives these details to a caller, enters them into a fraudulent link or shares them in a message, another person may try to use them for unauthorised banking activity. SBI therefore told customers never to share their OTP, PIN or password with anyone, including callers claiming to represent the bank.

SBI has said account balances and funds remain safe, but it continues to warn about suspicious communications. Customers should treat unexpected requests as risky, verify messages through official channels and report suspected unauthorised transactions promptly to the bank.