On 21 October 2026, State Bank of India (स्टेट बँक / स्टेट बैंक) told the stock exchanges that some customer data had shown up on the dark web. A first review found 3,897 records containing personal details such as name, mobile number, date of birth, address and branch/CIF numbers. Account numbers, balances, passwords, OTPs and card details were not on the list of exposed data. On the same day, a separate story came out about HDFC Bank reviewing two senior executives for allegedly leaking confidential business information. No report says HDFC customer data was involved.
Below we cover what has been confirmed, what is still unverified, why the two stories are different, and a short safety checklist. Marathi and Hindi summaries are at the end.
स्टेट बँक data leak: the quick facts
- What happened: A hacker going by "Siriusim" posted on BreachForums claiming to have SBI-linked data. SBI says a preliminary review found 3,897 records with personally identifiable information (PII).
- When SBI disclosed it: In a regulatory filing on Wednesday, 21 October. That was 5 days after the Defence Cyber Agency and CERT-In alerted the bank on 16 October.
- Money: Balances and account numbers were not among the exposed fields. SBI says services are running normally and there is "no material impact" on operations.
- Customer notice: SBI has not sent customers any notice, alert or lookup tool so far.
- The main risk for you: Fraud calls and messages that use your real details to sound like SBI.
What SBI's filing says was exposed, and what wasn't
The hacker claimed to have about 3.75 lakh CSV rows and 2,722 PDF documents, including loan applications, KYC records and account-opening forms. The post also suggested some data might come from unnamed SBI subsidiaries. SBI looked at the roughly 3.75 lakh records and found 3,897 that contained personal data.
| Reportedly exposed (per SBI filing) | Not listed in the filing |
|---|---|
| Name, gender, date of birth | Account numbers |
| Registered mobile number | Account balances |
| Email address | Passwords / net banking credentials |
| Home address | OTPs |
| Branch and CIF (customer ID) numbers | Debit/credit card details |
| Lead IDs and loan/lead metadata | PAN and Aadhaar numbers |
One caveat matters here. The hacker's samples reportedly include KYC documents, and SBI has not said whether any Aadhaar, PAN or passport copies were in the dataset. "Not listed" does not yet mean "confirmed safe."
Timeline: from dark web post to SBI's filing
| Date (2026) | What happened |
|---|---|
| 16 Oct | The X account CyberPulse56 flagged the BreachForums post by "Siriusim". The Defence Cyber Agency and CERT-In alerted SBI the same day. |
| 17 Oct | Free Press Journal checked 4 free sample records. The phone numbers were valid, and in one case a WhatsApp profile photo matched the KYC passport photo. SBI did not respond. |
| 19 Oct | India Today Tech reported that SBI still had not commented. |
| 21 Oct | SBI's exchange filing confirmed 3,897 PII records. The bank said it had started incident response and hired an independent, CERT-In-empanelled cybersecurity firm. |
The FPJ check suggests at least some records belong to real people. It does not prove the whole dataset is genuine or complete.
What is still unconfirmed
- Source of the data: Whether it came from SBI's own systems, a subsidiary or a third-party vendor.
- Whether a system was breached at all: SBI has not said that any of its systems were hacked.
- Number of people: It isn't clear whether 3,897 records means 3,897 different customers.
- KYC documents: Whether scanned Aadhaar, PAN or passport copies were part of the leak.
- Market reaction: We found no reliable reporting on how SBI shares moved after the filing. In the January 2019 case, when an SBI server without a password exposed account data, the stock fell about 3%.
Is this a "cyber attack" (সাইবার আক্রমন)?
Many Bengali-speaking readers are searching for "সাইবার আক্রমন" (cyber attack) about this story. Some headlines call it a cyberattack, but SBI's filing describes data found on the dark web and an investigation that is still going on. It has not confirmed an intrusion. A similar, almost identically worded notice from Bank of Baroda on 27 July 2026 was linked to a suspected business email compromise. Not every leak means a bank's core systems were broken into.
Why customers haven't been told directly
The Internet Freedom Foundation (IFF) has criticised SBI for issuing no customer notice, press release or advisory. It points to an RBI advisory from March 2026 (No. 3/2026) that recommends informing affected customers. In a letter to SBI's chairman, IFF made six demands. They include:
- Notices to affected customers in multiple languages
- A helpline or lookup tool so people can check whether they're affected
- A clear statement on whether Aadhaar, PAN or passport copies were exposed
- A compensation policy
Congress MP Pawan Khera said SBI "did not even detect the breach itself," since the alert came from outside agencies.
The legal gap: According to IFF, the DPDP Act's duty to notify affected individuals (Section 8(6)) only takes effect in May 2027. Until then, banks only have to report to regulators: within 6 hours to CERT-In and within 2–6 hours to RBI for the first report.
HDFC Bank executive information leak: a separate story
If you searched "hdfc bank executive information leak", "एचडीएफसी बैंक" or "എച്ച്ഡിഎഫ്സി ബാങ്ക്", here is the short version: this was not a hack, and no report says customer data was involved.
- On 21 October, Business Standard and India.com (citing NDTV) reported that HDFC Bank is reviewing two senior executives. They are accused of sharing confidential business strategy and market-sensitive information with outsiders. They have not been named.
- The bank is checking whether the information was misused. Findings were reportedly shared with senior management and some board members earlier this year, and both executives have been informed.
- HDFC Bank said: "Appropriate action will be taken based on the findings, once the review is complete."
- One source told Business Standard the matter may be linked to the MSRDC deposit issue. In July 2026, CEO Sashidhar Jagdishan, CFO Srinivasan Vaidyanathan and Arvind Vohra each received a warning letter and a ₹1 lakh penalty over it. This link comes from a single source and has not been confirmed.
Context: The bank is in a leadership change. Anup Bagchi, who joins from ICICI, takes over as MD & CEO on 27 October. Chairman Atanu Chakraborty resigned in March, and a legal review did not support his concerns. The stock is down about 28% this year, and the bank is valued at roughly US$115 billion. For the wider market picture, see our explainer on why the Indian stock market is falling.
HDFC Bank customers don't need to do anything specific because of this story. The usual safety habits below still apply.
What SBI customers should do now: a 6-step checklist
SBI has not published advice specific to this incident, so the steps below are general safety measures. The biggest risk is not someone draining your account straight away. It is convincing impersonation: a caller who knows your name, date of birth, branch and loan details and uses them to sound genuine.
- Treat every "SBI" call, SMS or WhatsApp message with suspicion, even if it gets your personal details right. SBI will never ask for your OTP, PIN, CVV or password.
- Never share OTPs or approve unexpected UPI collect requests. Don't install screen-sharing or "KYC update" apps because a caller tells you to.
- Change your passwords as a precaution. Passwords weren't listed as exposed, but your email address may have been. Change your email password, and your YONO/net banking password if you reuse passwords anywhere. Turn on two-factor authentication on your email.
- Check your statements and SMS alerts for the next few weeks. Look for unknown transactions, loan enquiries or changes to your account.
- Be extra careful about loan-related messages. The leaked data includes loan and lead details, so expect fake "loan approval", "processing fee" or "EMI pending" messages.
- Report quickly. If you lose money, call 1930 or file a complaint at cybercrime.gov.in straight away, ideally within the first hour. Forward phishing emails or messages to report.phishing@sbi.co.in. Our step-by-step guide explains how to report fraud on the 1930 cyber helpline.
Can I check whether my data was leaked? Not yet. There is no official lookup tool and no customer notice so far. Don't trust any website or caller offering to "check your SBI leak status". That is a common scam pattern.
मराठी सारांश: स्टेट बँक डेटा लीक
स्टेट बँक ऑफ इंडियाने (SBI) २१ ऑक्टोबर २०२६ रोजी शेअर बाजारांना कळवले की काही ग्राहकांची माहिती डार्क वेबवर आढळली आहे. सुमारे ३.७५ लाख नोंदींच्या प्राथमिक तपासणीत ३,८९७ नोंदींमध्ये वैयक्तिक माहिती आढळली. यात नाव, मोबाईल नंबर, जन्मतारीख, ईमेल, पत्ता, शाखा आणि CIF क्रमांक तसेच कर्जासंबंधी माहिती आहे. फाइलिंगमध्ये खाते क्रमांक, शिल्लक रक्कम, पासवर्ड, OTP, कार्ड तपशील, PAN किंवा आधारचा उल्लेख नाही. बँकेच्या मते कामकाजावर "मोठा परिणाम नाही" आणि स्वतंत्र सायबर सुरक्षा संस्थेमार्फत तपास सुरू आहे. ग्राहकांना अजून कोणतीही वैयक्तिक सूचना मिळालेली नाही.
काय करावे: SBI च्या नावाने येणाऱ्या कॉल, SMS किंवा WhatsApp संदेशांवर लगेच विश्वास ठेवू नका, जरी त्यात तुमचे नाव, जन्मतारीख किंवा शाखा बरोबर सांगितली असली तरी. OTP, PIN किंवा पासवर्ड कोणालाही सांगू नका. खात्यातील व्यवहार नियमित तपासा. फसवणूक झाल्यास लगेच १९३० वर कॉल करा किंवा cybercrime.gov.in वर तक्रार करा. HDFC बँकेचे प्रकरण वेगळे आहे. दोन वरिष्ठ अधिकाऱ्यांनी गोपनीय व्यावसायिक माहिती बाहेर दिल्याच्या आरोपाची ही अंतर्गत चौकशी आहे. यात ग्राहकांच्या माहितीचा उल्लेख नाही.
हिंदी सारांश: स्टेट बैंक डेटा लीक
भारतीय स्टेट बैंक (SBI) ने 21 अक्टूबर 2026 को स्टॉक एक्सचेंज को बताया कि कुछ ग्राहकों का डेटा डार्क वेब पर मिला है। करीब 3.75 लाख रिकॉर्ड की शुरुआती जांच में 3,897 रिकॉर्ड में निजी जानकारी मिली। इसमें नाम, मोबाइल नंबर, जन्मतिथि, ईमेल, पता, ब्रांच और CIF नंबर और लोन से जुड़ी जानकारी शामिल है। बैंक की फाइलिंग में खाता नंबर, बैलेंस, पासवर्ड, OTP, कार्ड डिटेल, PAN या आधार का ज़िक्र नहीं है। बैंक का कहना है कि सेवाएं सामान्य रूप से चल रही हैं और एक स्वतंत्र साइबर सुरक्षा फर्म जांच कर रही है।
अब क्या करें: SBI के नाम से आने वाली कॉल या मैसेज पर भरोसा न करें, भले ही उसमें आपकी सही जानकारी हो। OTP, PIN और पासवर्ड कभी साझा न करें। अपना स्टेटमेंट नियमित रूप से जांचें। धोखाधड़ी होने पर तुरंत 1930 पर कॉल करें या cybercrime.gov.in पर शिकायत करें। एचडीएफसी बैंक का मामला अलग है। वह दो वरिष्ठ अधिकारियों पर गोपनीय कारोबारी जानकारी लीक करने के आरोप की आंतरिक जांच है। इसमें ग्राहकों के डेटा का कोई ज़िक्र नहीं है।
What to watch next
There are three things to look out for. First, whether SBI sends notices to affected customers or sets up a lookup tool, as IFF has demanded. Second, the findings of the independent forensic firm on where the data came from. Third, any action HDFC Bank announces after its review, especially once Anup Bagchi takes charge on 27 October. We'll update this story as official statements come in. For more news on banking, money and online safety, visit the KyunTrend homepage.