The SBI data leak: what customers and businesses should do now

Leaks of personal data from banks rarely empty accounts directly. What they do is make the next scam convincing: a caller who knows your name, your date of birth and the details of your loan sounds exactly like the bank. This post sets out what SBI has said as of 23 October 2026, what to watch for, and what other businesses can learn from it.

What SBI has disclosed

• 16 October 2026: SBI says it received alerts about a suspected exposure of data from its threat intelligence provider, the Defence Cyber Agency and CERT-In.
• 21 October 2026: SBI filed a disclosure with the stock exchanges titled "Incident involving Data Loss". It said that of about 3.75 lakh records found on the dark web, it had identified 3,897 customer records containing personal information.
• The data reportedly includes names, mobile numbers, dates of birth, email and residential addresses, and loan-related details.
• Impact: SBI said the incident had no material impact on its core operations, and that it had activated its incident response and engaged an independent CERT-In empanelled agency to investigate.
• Customers: SBI has since said it individually informed all customers whose data was identified, by email and/or WhatsApp, and that account balances and funds are safe.

A group calling itself Siriusim has reportedly claimed responsibility. That claim has not been verified, and SBI has not said how the data was exposed. Until the investigation reports, the cause is unknown, and this post does not guess at it.

What it means for customers

Names, phone numbers, dates of birth and loan details are exactly what a fraudster needs to sound like the bank. Expect calls and messages that quote your real details and then ask for something: an OTP to "verify" a loan, a KYC update through a link, or an app to install so that "support" can help. The rules do not change because the caller knows your details:

• The bank will not ask for your OTP, PIN, password or CVV. SBI itself has urged customers never to share them with anyone.
• Hang up and call the bank on the number on your card, passbook or the official website, not a number the caller gives you.
• Do not install apps or share your screen at a caller's request.
• Be wary of messages saying "your data was leaked, click here to check". Those can be scams too.
• If money is taken, tell your bank immediately and report it to the national cybercrime helpline, 1930, or at cybercrime.gov.in.

What it means for businesses

Staff who bank or borrow with SBI may be targeted at work as well as at home. A short note to the team, especially finance and anyone who handles payments, about bank-impersonation calls is worth sending this week. The same callback discipline that stops invoice fraud stops these calls: verify on a number you already had.

Lessons for any business that holds customer data

Without knowing how this exposure happened, some lessons apply to every organisation that keeps personal data about customers:

• Know where copies live. Personal data rarely stays in one database. Exports, spreadsheets, PDFs, reports emailed to staff and files shared with partners all count, and each is a copy to protect.
• Limit bulk access and exports to the people who need them, and log who downloaded what.
• Expect to hear about it from outside. SBI learned of this through alerts from outside the bank. Threat intelligence and monitoring for your own data appearing elsewhere are part of detection.
• Have the response ready before you need it: who investigates, who decides on reporting, and who speaks to customers. CERT-In's directions require specified cyber incidents to be reported within six hours of being noticed; see CERT-In's log rule.
• Plan for breach notification. Under the Digital Personal Data Protection Act, data fiduciaries will have to notify the Data Protection Board and the affected individuals of a personal data breach, under rules that take full effect in May 2027. See DPDP Act: what to actually do and our DPDP readiness work. This is infrastructure guidance, not legal advice.
• Tell people plainly. When customers are affected, a clear notice saying what data was involved, what to watch for and how to reach you does more to limit harm than a statement written only for investors.

If you have just received a suspicious call or message and acted on it, the first hour after a phishing click sets out what to do next.

Sources

• SBI's disclosure to the stock exchanges, 21 October 2026, as reported by Bloomberg, via Insurance Journal and the Internet Freedom Foundation
• SBI's statement to customers, as reported by The Hans India, 23 October 2026