Shield
Probe
Strike
Grow
Flow
Pulse
BlinkSBI Data Breach: 3.75 Lakh Records Surfaced on the Dark Web
Published by Ketan Ramshawala, CTO
India's largest bank did not find its own leak. In the SBI data breach, three outside parties told State Bank of India (SBI) that its customer data was on the dark web, the hidden part of the internet where stolen data is traded. If SBI needed outsiders to raise the alarm, how would your bank, NBFC or fintech know?
Here's what happened, why a leak of "basic" details hurts the institution too and what to do in the first days of a leak and before one.
What happened in the SBI data breach?
On 16 October 2026, SBI received alerts from its threat intelligence service provider, the Defence Cyber Agency and CERT-In (the Indian Computer Emergency Response Team). A first look at about 3.75 lakh records found 3,897 containing personally identifiable information such as names, dates of birth, mobile numbers, addresses, branch and customer IDs and loan details.
SBI told the stock exchanges on 21 October under SEBI's listing rules. It activated its cyber incident response and containment protocols, engaged an independent CERT-In-empanelled cybersecurity agency and reported no material impact on its business or finances.
SBI's disclosure to BSE and NSE under Regulation 30 of SEBI (LODR) Regulations, 21 October 2026
For a listed lender, the cost showed up on the trading screen the same day. Within hours of the SBI data breach news, the shares slipped about 1%.
SBI on the NSE, 21 October 2026: closed at ₹963, down 1.1% from ₹973.70. (Screenshot: Google Finance)SBI hacked or leaked from somewhere else?
Nobody knows yet. SBI says it has not established where the data came from. A group calling itself "Siriusim" claims to have released 3.75 lakh rows and 2,722 PDFs, including loan applications, but sample checks couldn't show whether they came from SBI, a subsidiary or a vendor. So calling it an SBI hack runs ahead of the evidence, a direct SBI cyber attack is one possibility among several.
That uncertainty is the lesson for lenders. Loan files pass through subsidiaries, direct selling agents (DSAs), collection agencies and software vendors. Any of them can be the exit point and your customers will still blame you.
Why a leak of "basic" details becomes the institution's problem
The fields in the SBI dark web leak cannot move money on their own.
Listed in SBI's filing | Not listed in the filing |
Name, gender and date of birth | Passwords, OTPs and PINs |
Registered mobile number and email | Card numbers |
Home address | Account numbers and balances |
Branch and CIF number (internal customer ID) | PAN and Aadhaar numbers |
Lead IDs and loan or lead details | Copies of KYC documents |
What they can do is make a fraudster sound exactly like your staff. A caller who quotes a customer's birth date, branch and loan enquiry gets the OTP. The money is lost on the customer's side, but the complaint, the call-centre load and the headline land on yours.
Trust takes the hit first and in public.
Public reactions on X after the disclosure
Is this a one-off or can it happen to you too?
It isn't a one-off. Leaks at Indian banks, insurers and fintechs surface almost every year and in every case below the alarm came from outside: a journalist, a researcher, an anonymous tipster or a threat intelligence feed.
Year | Organisation | What came out | Source |
2019 | SBI | An unprotected SBI Quick server exposed partial account numbers, balances and mobile numbers. | |
2024 | Star Health Insurance | Telegram chatbots offered customer names, addresses, ID copies and medical reports. | |
2025 | Axis Max Life Insurance | An anonymous sender reported unauthorized access to customer data. | |
2025 | NACH transfer records | About 273,000 bank transfer PDFs from at least 38 banks and financial firms sat in an open cloud folder. | |
2026 | Bank of Baroda | After an anonymous claim of access, the bank pointed to a potential business email compromise. | |
2026 | SBI | 3,897 customer records with personal details found among 3.75 lakh on the dark web. |
Why banks keep sending fraud alert messages
Each leak feeds the fraud pipeline. Between 2021 and 2025, Indians filed more than 65 lakh financial fraud complaints on the National Cybercrime Reporting Portal, reporting losses above ₹55,000 crore. Scammers armed with leaked details are why banks keep texting "never share your OTP". Those texts protect customers at the last step, but they can't be an institution's whole defence.
How would you know if your customers' data leaked?
Most institutions find out from someone else. These are the usual first signs:
- A threat intelligence or dark web monitoring alert naming your brand or data.
- A notice from CERT-In or your regulator.
- An anonymous tip, a sample file or a ransom email.
- Customers reporting scam calls that quote their account or loan details.
- Unusual exports, logins or API calls in your own logs.
The first four mean someone else knew before you did. Only the last is yours and only if the logs exist and someone reads them. CERT-In's 2022 directions already require 180 days of logs kept in India, so the data is usually there. The gap is watching it.
What lenders should do first when a leak surfaces
SBI's filing names the right sequence: contain, investigate independently, then put preventive measures in place. For a bank, NBFC or fintech, the first days look like this:
- Contain. Isolate affected systems, revoke vendor and API access (the keys systems use to talk to each other), reset credentials and preserve every log.
- Report on time. CERT-In expects a report within six hours of noticing an incident. RBI-regulated banks and NBFCs report on RBI's DAKSH portal within six hours under the 2026 directions and listed firms disclose to the stock exchanges.
- Investigate independently. Engage a CERT-In-empanelled cybersecurity agency for a comprehensive assessment of the nature and extent of the compromise: whether the data is genuine, where it left from and how far it spread.
- Map every copy. List where the same data lives: subsidiaries, DSAs, collection agencies, cloud storage and vendors.
- Tell affected customers. Explain what leaked, which scams to expect and where to report them, such as the national cybercrime helpline 1930 or a phishing-report address like SBI's report.phishing@sbi.co.in.
- Put preventive measures in place. Close the gap found, then test again before declaring it closed.
Why NBFCs and fintechs shouldn't wait for their own leak
A smaller lender holds the same names, birth dates and loan files as SBI, with a fraction of the security team.
The better way to prevent a leak is to close the gaps before anyone else finds them:
- Outside watch : A cyber security and threat intelligence service provider that monitors leak sites for your data. SBI heard first from its provider; most smaller lenders have none.
- Testing like an attacker : Regular, independent testing of websites, apps and APIs, including what vendors expose on your behalf.
- Staff email : Checking whether staff work addresses appear in breaches, since a compromised employee inbox is where Bank of Baroda's first findings pointed.
How Synctric Security’s Shield and Probe cover these gaps
Two Synctric Security tools cover parts of this.
Shield by Synctric: Watches your team's email addresses and alerts you when one appears in a known breach, including old accounts staff signed up for and forgot.
Probe by Synctric: Runs automated security tests across your websites, APIs, cloud and mobile apps, shows proof for the weaknesses it finds and produces audit-ready reports. Neither replaces an incident response team. Both help you find exposure before an outside alert does.
The leak is small. The trust cost is not.
A few thousand confirmed records is a small number for a bank of SBI's size. But birth dates and addresses don't expire, so scams built on them can run for years under your name. The institutions that come through a leak well are the ones that hear about it first and tell their customers before anyone else does.
Frequently Asked Questions:
1. How many SBI customers were affected by the data breach?
SBI has confirmed 3,897 records with personal details so far. Some reports said 3.75 lakh customers, but that is the size of the leaked data set SBI checked, not the confirmed count. The final number depends on the investigation.
2. Why do hackers target banks, NBFCs and fintechs?
Because their data sells. Names, birth dates, phone numbers, addresses and loan details are enough to pose as the lender and talk customers into sharing OTPs, even without passwords. Smaller NBFCs and fintechs are targets too, since they hold similar data with fewer people guarding it.
3. How does a data breach affect a bank or fintech’s business?
Most of the cost comes from lost trust. Customers get angry, complaints flood the call centre, scammers make calls in the company’s name and, for listed firms, the share price can drop. For a smaller lender with fewer customers to lose, that damage cuts deeper.
4. How can a company find out if its data is on the dark web?
Through dark web monitoring. A security provider scans hacker forums, leak sites and chat channels for your company’s name, web addresses and data and alerts you when something appears. In SBI’s case, its threat intelligence provider was one of the first to raise the alarm.
5. What should a company do first after discovering a data breach?
Stop the leak, then get the facts straight. Cut off the access that lets the data out and keep every log. Bring in an independent security firm to check what was taken. Then tell affected customers plainly what happened and how to avoid scam calls.
6. How can banks and NBFCs prevent a customer data breach?
Limit who can view and export customer data, give vendors only the access they need and train staff to spot phishing. Then use security testing tools to find weak spots in your apps and systems before attackers do and breach monitoring tools to warn you when staff accounts or company data show up in a leak. Together, they cut the chances of a breach and help you catch one early.
