State Bank of India investigates reported exposure of 3,897 customer records

State Bank of India (SBI) is investigating after an alert about data appearing on the dark web. The bank said it does not yet know whether the material is authentic, who posted it or how it was obtained.

In a filing, SBI said it was contacted in mid-October 2026 by its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In about the alert. The filing said 375,000 records were apparently made available, including 3,897 bank customer records containing personally identifiable information. The reported fields included names, mobile numbers, dates of birth, email and residential addresses, and branch and customer identifiers.

An account called CyberPulse56 flagged a forum post dated October 16, 2026, in which a threat actor called Siriusim claimed to have 375,000 CSV rows and 2,722 PDF documents belonging to the bank. The Free Press Journal reported that at least some data in a sample was authentic, but found no information linking it to SBI, its subsidiaries or its third-party providers.

SBI said it has begun an investigation, activated incident-response and containment protocols, and engaged an independent CERT-In-empanelled cybersecurity agency for forensic analysis. The bank said the incident has no material impact on its operations and that it expects to continue functioning as usual. The available information does not establish whether SBI was breached.