SBI hacked? SBI confirms 3,897 customer records leaked on the dark web, and 6 things customers should do now

"SBI hacked" became one of India's fastest-rising searches on Tuesday. On Wednesday, 21 October, SBI confirmed part of it: 3,897 customer records with personal details are on the dark web. Here's what the bank said, what's still unknown, and the steps worth taking.

Update, 22 Oct: SBI confirms 3,897 customer records leaked

In a stock exchange filing on 21 October, SBI said it got alerts on 16 October from its threat-intelligence provider, the Defence Cyber Agency and CERT-In about customer data exposed on the dark web. A preliminary analysis of roughly 3,75,000 records found 3,897 customer records with personally identifiable information: names, mobile numbers, dates of birth, email and residential addresses, branch and customer identifiers, and data linked to loan and lead records, as reported by Reuters, The Hindu and Mint.

SBI says it activated its incident-response protocols and hired an independent CERT-In-empanelled agency to find the source and extent. On X it said "Customer balances are completely safe" and that the leak affects "a very small number of customers". The filing doesn't name Siriusim or say where the data came from. The Hindu reports that SBI couldn't confirm whether it has contacted affected customers individually, and the Internet Freedom Foundation has asked it to tell each of the 3,897 people by SMS, email and letter.

What this changes for you: if you've ever applied for an SBI loan, assume your phone number, date of birth and address may be in scammers' hands, and follow the six steps below. SBI hasn't launched any tool to check whether you're affected, so any link or caller offering to check is a scam.

What the hacker group claims

On 16 October, the cybersecurity monitoring account CyberPulse56 posted on X that a threat actor called Siriusim had put up data "allegedly associated with" State Bank of India on BreachForums, a dark-web forum where stolen data is traded. According to that post, as reported by India Today, the group claims:

• 3,75,000 rows of data in CSV (spreadsheet) format
• 2,722 PDF documents
• personal customer information and residential addresses
• loan applications and their supporting documents
• account-opening applications

The group called this its "first disclosure" of the dataset and posted what it says are four sample customer records. India Today notes that, if real, the documents could include KYC records and Aadhaar numbers.

What's confirmed and what isn't

Before SBI's filing: India Today, The Economic Times, Moneycontrol and The Free Press Journal all wrote to SBI, and none had a response by the time they published. Moneycontrol's update at 4:28 PM IST on 20 October still said SBI hadn't commented. SBI's 21 October filing (above) now confirms 3,897 customer records.

Partly checked: The Free Press Journal looked at the public samples. It found the phone numbers were valid, and in one case a WhatsApp profile photo matched the passport photo on the leaked KYC document. So at least some sample data seems to belong to real people. FPJ is clear that this doesn't establish the whole dataset is genuine, or how it was obtained.

Not known:

• Where the data came from. SBI's filing doesn't say. It could come from an SBI subsidiary, a loan sourcing agent or a third-party service provider that handles applications, or it could be recycled from an older leak. Most of the records are reportedly loan-related.
• Whether more people are affected. SBI counts 3,897 customer records with personal data so far, from a preliminary analysis. Before the filing, as Moneycontrol points out, 3,75,000 rows doesn't tell you how many individual customers are in it. Headlines saying "3.75 lakh accounts hacked" go beyond the claim.
• Whether anyone's account was accessed. Nothing in the claim mentions net-banking passwords, PINs, OTPs or card numbers.

Why this still matters for you

Even if your account is safe, leaked KYC and loan paperwork is a gift to scammers. A fraudster who can read out your address, PAN or loan amount sounds far more believable when they call "from SBI" to ask you to "re-verify KYC", "stop a suspicious transaction" or "close a loan in your name." India Today warns that leaked details can also be combined with AI-written messages or cloned voices. The other risk is someone using your documents to apply for a loan in your name.

The timing also matters. Moneycontrol notes that CERT-In warned financial institutions on 9 October about attacks using stolen credentials, and ET reported on 15 October that around 20 banks, NBFCs and fintechs had been hit through stolen credentials and payment-API flaws. No link between those incidents and the SBI claim has been established.

6 things SBI customers should do now

1. Don't share an OTP, PIN or password with anyone, for any reason. SBI's cyber security page is clear that the bank never asks for these. This one rule blocks most of the frauds a leak could lead to.
2. Treat any call or SMS that mentions this "breach" as a scam until proven otherwise. That includes offers to "check if your data leaked", "secure your account" or "update KYC". Hang up and call SBI back on a number you find yourself on its official website.
3. Never install an app a caller asks you to. Screen-sharing and "support" apps (AnyDesk-type tools, or APK files sent on WhatsApp) let fraudsters watch you type your OTP.
4. Turn on and read your SMS and email alerts. Check your statement in YONO or net banking for anything you don't recognise.
5. Lock your Aadhaar biometrics on UIDAI's official myAadhaar portal or the mAadhaar app if you've shared Aadhaar with SBI for a loan or account. You can unlock them whenever you need to.
6. Check your credit report from a credit bureau over the next few weeks, especially if you ever applied for an SBI loan. A loan or enquiry you don't recognise is an early sign that someone is using your documents.

If you get a suspicious call or SMS, report it on the government's Sanchar Saathi Chakshu page. If money has already gone, call 1930 immediately. The first hour matters most for freezing the money. Then file at cybercrime.gov.in and tell SBI. Our 1930 cyber fraud helpline guide gives the exact order to follow.

What happens next

Under RBI's July 2026 cyber security directions, banks have to report a cyber incident to the regulator through its DAKSH platform within six hours of detecting it, and notify CERT-In, Moneycontrol reports. If SBI's investigation finds customer data was exposed, the next thing to watch for is an official notice from SBI to affected customers. That would come through SBI's own channels, not from a stranger on the phone.

SBI has now made its disclosure. We'll update this story when its investigation names the source, or when SBI, RBI or CERT-In tells affected customers what to do.

1. 9 Oct 2026

   CERT-In warns financial institutions about attacks using compromised credentials and unauthorised fund transfers (Moneycontrol). No link to the SBI claim has been established.

2. 15 Oct 2026

   ET reports cyberattacks on around 20 banks, NBFCs and fintechs via stolen credentials and payment-API flaws.

3. 16 Oct 2026

   CyberPulse56 flags Siriusim's BreachForums post claiming SBI-linked data: 3,75,000 CSV rows and 2,722 PDFs.

4. 19 Oct 2026

   India Today (2:01 PM IST) and FPJ report the claim; FPJ finds some sample phone numbers are real.

5. 20 Oct 2026

   ET (1:23 AM IST) and Moneycontrol (4:28 PM IST) report SBI still hasn't responded. 'sbi hacked' searches surge +18,150%.

6. 21 Oct 2026

   SBI's stock exchange filing confirms 3,897 customer records with personal data among ~3,75,000 dark-web records; SBI posts on X that balances are safe (Reuters, The Hindu, Mint).