SBI Data Leak on the Dark Web: What SBI Said and What to Do

State Bank of India told the stock exchanges on 21 October 2026 that a preliminary analysis of about 3.75 lakh records found on the dark web identified 3,897 customer records containing personal information, such as names, mobile numbers, dates of birth and addresses. SBI said the source, authenticity and full extent were still being established. If you bank with SBI, expect scam calls and messages that quote your real details, never share an OTP, PIN or password, and use SBI's official numbers to block and report anything suspicious.

Who this guide is for

This guide is for SBI account holders and borrowers, and for anyone helping a parent or relative who banks with SBI. It sets out what SBI has officially disclosed, what is still unknown, and the practical steps to protect your money and identity. EpiFive is not affiliated with SBI; every number below comes from SBI's own website, so you can check it yourself.

What happened

SBI made the disclosure in a filing to BSE and NSE under Regulation 30 of the SEBI listing rules, dated 21 October 2026 and titled "Incident involving Data Loss". In it, SBI said:

• "the Bank has experienced an incident involving the loss of certain data."
• On 16 October 2026 it received communications from its threat intelligence service provider, the Defence Cyber Agency and CERT-In about "the suspected exposure of the Bank's customer data on the dark web."
• "During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified."
• "A detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank."
• It activated its cyber incident response and containment protocols and engaged "an independent CERT-In-empanelled cybersecurity agency" to assess and investigate.
• The incident "does not have any material impact on Bank's Core business operations, financial performance or business continuity."

What data SBI says was involved

According to the filing, the exposed information "reportedly included" these fields:

The filing does not mention passwords, PINs, OTPs, card numbers or CVVs. It also does not say whether affected customers will be contacted individually. As of 12 November 2026, we found no later SBI exchange filing updating these figures.

Am I affected?

SBI has not published a way to check whether your record is among the 3,897, and it said its investigation into the source and extent was continuing. Treat yourself as possibly affected if you are an SBI customer, and particularly if you applied for or were offered an SBI loan, because the filing mentions "lead IDs" and "loan/lead records".

The practical risk is social engineering. A fraudster who knows your name, CIF number, branch and the loan you enquired about can sound exactly like a bank employee. Knowing your details does not make a caller genuine.

What to do now

1. Be suspicious of calls, SMS and WhatsApp messages that use your details

Expect messages about "KYC expiry", a "blocked" YONO or net banking account, a "pre-approved loan" that needs a processing fee, reward points about to lapse, or an EMI problem. Do not click links, do not install apps or APK files sent in messages, and do not call numbers given in the message. See our guide to spotting phishing SMS and email in India for common patterns.

2. Never share OTP, PIN, CVV or passwords

SBI's contact centre page says "SBI does not ask for OTP and advises not to share with anybody." Its contact page says the bank never asks for "your user id / password / pin no. through phone call / SMSes / e-mails", and its cyber security page adds that the bank never asks for card numbers or CVV. Anyone who asks for these is a fraudster, even if they quote your CIF number.

3. Verify that a call is genuinely from SBI

• Under a TRAI direction of 19 November 2025, commercial banks, including public sector banks, had to move their service and transactional calls to the 1600 number series by 1 January 2026. A caller who claims to be from SBI on an ordinary 10-digit mobile number is a red flag.
• No matter which number calls you, end the call and ring SBI yourself on a number from its official website: 1800 1234 or 1800 2100 (also 1800 11 2211 and 1800 425 3800, all toll free; 080-26599990 is the toll number).
• Never trust a "customer care" number from a search ad, social media post or message. Our guide to the fake customer care number scam explains why.

4. Check your credit report for loans you did not take

Personal details from a leak can be used in loan or credit card applications in your name. The RBI requires each credit information company to give you one free full credit report, including your credit score, once in every calendar year. Download your report from each bureau (TransUnion CIBIL, Experian, Equifax and CRIF High Mark) and look for accounts or enquiries you do not recognize. The RBI also requires bureaus to send an SMS or email alert when a lender accesses your report and the enquiry appears in it, so an unexpected alert deserves a follow-up.

5. Lock your Aadhaar biometrics if you do not use them

UIDAI's free biometric lock blocks fingerprint, iris and face authentication on your Aadhaar. UIDAI says you need a registered mobile number, an OTP turns the lock on or off, and you can do it through the UIDAI website (myAadhaar) or the Aadhaar app. OTP-based authentication keeps working, and a temporary unlock lasts "generally 15 minutes" or one transaction. The UIDAI helpline is 1947.

6. Turn on alerts and review your accounts

Make sure SMS alerts reach your current mobile number, check your statement for debits you do not recognize, and review any standing instructions or UPI mandates you did not set up.

If you have lost money or shared details

Act immediately. Under RBI rules, how fast you report an unauthorised electronic transaction affects how much of the loss you may have to bear.

1. Block access. Call 1800 1234 or 1800 2100 and press 0 in the main menu for "Block ATM Card, INB & UPI", then choose ATM card block, internet banking block or UPI block.
2. Report the transaction to SBI. For unauthorised electronic transactions SBI lists 1800 11 1109 and 94491 12211 (toll free), and 080-2659 9990 (toll).
3. Report the fraud. Call 1930 or file a complaint on cybercrime.gov.in. SBI also asks customers to report cyber incidents to [email protected]. Keep transaction IDs, the caller's number and screenshots.
4. Change credentials. Change your YONO, internet banking and UPI PINs and passwords, and secure the email account linked to your bank.
5. Escalate if needed. If SBI does not resolve your complaint, you can complain to the RBI Ombudsman at cms.rbi.org.in (contact centre 14448).

If your mobile number suddenly loses signal, your SIM may have been swapped: see SIM swap fraud. If a caller threatens arrest on a video call, read about the digital arrest scam.

How to protect yourself after any bank data leak

• Assume anyone who knows your details may still be a fraudster.
• Contact the bank only through numbers on its official website, app, passbook or statement.
• Keep OTP, PIN, CVV and passwords private, always.
• Check your credit report every year and after any breach.
• Keep Aadhaar biometrics locked when you do not need them.
• Report every attempt on 1930 or cybercrime.gov.in, even if you lost nothing.

SBI's website is now at sbi.bank.in; when we checked, links on www.sbi.co.in redirected there. Treat any look-alike domain as fake.

What we checked

• Downloaded SBI's 21 October 2026 Regulation 30 filing ("Incident involving Data Loss") from bseindia.com on 2026-11-12 and quoted its wording directly; the 375,000 and 3,897 figures, the 16 October alert and the list of exposed fields come from that filing.
• Searched for a later SBI exchange filing on the same incident and found none as of 2026-11-12.
• Opened SBI's customer care contact page, Contact Centre page and Cyber Security page on sbi.bank.in for the toll-free numbers, the unauthorised-transaction numbers, the IVR "Press 0" blocking menu, [email protected] and the "does not ask for OTP" statement; the four toll-free numbers matched on two SBI pages.
• Checked the PIB release of 19 November 2025 on TRAI's direction requiring commercial banks to adopt 1600-series numbers by 1 January 2026.
• Checked UIDAI's authentication FAQ for the biometric lock rules and the 1947 helpline, the RBI Credit Information Companies Directions, 2025 for free annual reports and access alerts, cms.rbi.org.in for the Ombudsman contact centre, and the PIB release on 1930 and cybercrime.gov.in.
• Not verified: who obtained the data, how it reached the dark web, and claims by individual sellers. SBI has not disclosed the source as of 2026-11-12, so this guide does not speculate about it.

Last tested: 2026-11-12

Sources

• State Bank of India, Disclosure under Regulation 30: Incident involving Data Loss, 21 October 2026, BSE: https://www.bseindia.com/xml-data/corpfiling/AttachLive/e16e3a1a-ee15-4971-977c-5f9f6aef1fb9.pdf
• SBI, customer care contact page: https://sbi.bank.in/web/customer-care/contact-us
• SBI, Contact Centre: https://sbi.bank.in/web/customer-care/contact-centre
• SBI, Cyber Security: https://sbi.bank.in/web/personal-banking/cyber-security
• PIB, TRAI direction on 1600-series numbers for BFSI entities, 19 November 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2191647&reg=3&lang=1
• UIDAI, Authentication FAQs (Aadhaar lock and biometric lock): https://uidai.gov.in/en/authentication
• RBI, Credit Information Companies Directions, 2025: https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=12926
• RBI, Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11040&Mode=0
• RBI Complaint Management System: https://cms.rbi.org.in
• PIB, Ministry of Home Affairs, 28 July 2026 (1930 and cybercrime.gov.in): https://www.pib.gov.in/PressReleasePage.aspx?PRID=2290366&reg=3&lang=1
• National Cyber Crime Reporting Portal: https://cybercrime.gov.in