SBI confirms dark-web leak of 3,897 customer records

SBI told the stock exchanges its dark-web data leak has no material impact on the bank. Nothing in the filing tells the 3,897 customers named in the data what to do. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. This is not an account-takeover kit. It is an impersonation kit, and no one is coming to warn the people inside it.

The disclosure arrived Wednesday, 21 October, as a Regulation 30 filing under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, titled "Incident involving Data Loss", reported by the Indian Express.

The filing answered the wrong question

The filing's headline message was written for one audience. SBI's own words:

"No material impact on core business operations, financial performance or business continuity."

That is the only question a listing regulation asks a bank to answer: are the shareholders hurt. The customers named in the file are not in that sentence.

What the bank was reacting to: on 16 October it received alerts from three separate sources, its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In, about suspected customer data on the dark web. Investigators examined roughly 375,000 records and identified 3,897 customer records containing personally identifiable information. The fields, per the filing: registered mobile numbers, dates of birth, names, gender, email IDs, residential addresses, branch and Customer Information File (CIF) identifiers, lead IDs, and metadata tied to loan and lead records plus other related files.

Read the passwords line carefully. The filing does not list passwords, PINs or one-time passwords among the exposed data, and no stolen funds have been reported. That describes the filing's contents. It is not a clean bill of health for any system.

The honest split:

Five days before the filing, an actor calling itself Siriusim claimed on BreachForums to have released 3.75 lakh rows of SBI-linked data in CSV format, along with 2,722 PDF documents described as loan applications, supporting documents and account-opening applications. The claim was flagged on X by the monitoring account CyberPulse56 and picked up by YourStory and the Economic Times before SBI said anything. It is unverified, and SBI's findings do not attribute the incident to any named attacker. Treat the actor name and the 3.75 lakh figure as claims, not facts. The Free Press Journal examined four sample records the actor posted and found the phone numbers real, according to YourStory's reporting. That is a report, not a verification.

Who tells the 3,897?

The Internet Freedom Foundation went looking for a customer notice, a press release or an advisory from SBI and found none. So IFF wrote to SBI's chairman, with copies to the RBI governor and the CERT-In director general, demanding that every affected customer be told directly by SMS, email and letter, that a helpline and a self-check facility be set up, and that the bank disclose what the 2,722 PDF documents contain and whether KYC documents like Aadhaar or PAN copies are in them.

Indian law will not close this gap in time. Section 8(6) of the Digital Personal Data Protection Act, 2023, which would require a data fiduciary to notify each affected person of a breach, takes effect only in May 2027 under the staggered commencement, per IFF's analysis. The RBI's Advisory No. 3/2026 of March 2026 recommends banks notify affected customers, but it is non-binding. A bank can meet every reporting obligation on paper and still leave its customers uninformed. That is exactly what this picture looks like.

So assume no one calls you with a warning. If the phone rings and the caller quotes your branch, your CIF number and your loan application, you will have had no official notice to check them against. Prepare for the call, not for the press coverage.

A caller who reads your name, date of birth, branch and loan details back to you is proving they hold the file, not that they are SBI. Hang up and call the bank on the number printed on your card. No legitimate bank process starts with a stranger proving they know you.

The field you could have made traceable

Your name, your date of birth, your mobile number and your CIF identifier are not fields you can rotate. Once they circulate, they circulate. Your email address was the exception: the one field in this leak you could have made expendable before anything happened.

The mechanism is an email alias dedicated to the bank, forwarding to your real inbox. Daily use changes nothing; the bank's mail arrives as normal. The impersonation math changes completely. The real SBI holds exactly one address for you: the alias. A "security alert" that lands on any other address has identified itself as the forgery, because the bank never had that address. And when the leaked data circulates with the alias inside it, the alias names the source: that is the leak-tracing mechanism. Aliases are managed, persistent identities, one per service, kept for as long as the service needs them.

Plain limits. An alias does not take back this breach. The phone numbers and the loan metadata are out no matter which address the bank held, and the impersonation call will come over the phone, not the inbox. What the alias buys is a channel test for the bank's own messages and a source label on every message that arrives after the leak. One defensive layer, not the whole answer.

If you bank with SBI

1. Expect the call that knows too much. Anyone reading your own details back to you is proving they have the file, not that they are SBI. Hang up and call the bank through the number on your card or the official app.
2. Click nothing about this breach. Open the SBI app or type the address yourself. The phishing wave will quote the filing's real language to look credible.
3. Never share OTPs, PINs or passwords with a caller. SBI never asks for those. Hang up.
4. Watch your statements for unauthorised transactions. Report them to SBI on 1800 1111 09 or report.phishing@sbi.co.in, and to the national cybercrime helpline on 1930 or at cybercrime.gov.in (helplines via IFF).
5. Change reused passwords. The filing lists no passwords, but credential stuffing pairs your leaked email with passwords from other breaches. If your banking password matches one used anywhere else, change it there now.
6. Check Have I Been Pwned once the incident is listed and turn on its breach notifications. Then walk the breach-response order of operations.

What the investigation still owes

Three open threads. First, whether SBI upgrades the preliminary analysis to confirmed exfiltration and clarifies whether the 3,897 records are 3,897 unique customers, and what the remaining roughly 371,000 records contain. Second, the 2,722 PDFs: if those really are loan and account-opening applications, the affected population is far larger than 3,897, and the KYC question IFF asked, Aadhaar and PAN copies, gets serious. Keep the hedge in view: the PDF claim is the actor's, unverified, and the filing says nothing about it. Third, the source. IFF flagged that lead IDs and loan metadata point toward the lead-management side of lending, where vendors and direct selling agents handle customer data. If the investigation confirms that, the question becomes which third party held this much identity data, and under what contract.

Then there is the pattern. Bank of Baroda disclosed a cybersecurity incident to the exchanges in late July 2026, in near-identical regulatory language, after an anonymous communication claiming access to its data; its preliminary cause was "potential business email compromise", and the forensic investigation was still establishing scope when Cyber Security News covered it. Two state-owned banks in three months, both learning about their customer data from the outside, both telling the exchanges first. The customer finds out from the filing, if at all.