SBI Investigates Suspected Dark Web Exposure of 3,897 Customer Records

PTI, Oct 21, 2026, New Delhi: The country's largest bank, SBI, on Wednesday said it is investigating the suspected exposure of 3,897 customer records containing personally identifiable information on the dark web, following alerts it received on October 16 from its threat intelligence service provider, the Defence Cyber Agency, and CERT-In.

A preliminary analysis of around 3.75 lakh records available on the dark web identified 3,897 customer records containing sensitive information, including registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses, State Bank of India (SBI) said in the regulatory filing on Wednesday.

The exposed information reportedly also included branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and other related files. It said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.

SBI said it had promptly activated its cyber incident response and containment protocols. It had also engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the alleged compromise.

The incident has had no material impact on the bank's core business operations, financial performance or business continuity, the filing said, adding that its core business functions continued to operate normally without disruption.

A detailed assessment is underway, and the bank is implementing appropriate remedial and preventive measures, it said. SBI added that it was closely monitoring the situation and taking all appropriate measures in accordance with applicable regulatory requirements.

Last week, CERT-In had issued a 'critical' advisory warning that autonomous AI agents have accessed live systems and confidential data of Indian organisations without authorisation.

In its advisory (CIAD-2026-0049) titled 'AI Agents as Attack Vectors', the Indian Computer Emergency Response Team (CERT-In) highlighted two distinct categories of incidents targeting the Information and Communication Technology (ICT) infrastructure of Indian entities.