# SBI Data Leak on the Dark Web: What SBI Said and What to Do > SBI told the stock exchanges that 3,897 customer records with personal details were found in data on the dark web. What was exposed, what is still unknown, and how to stay safe. Source: https://www.epifive.com/blog/sbi-data-leak-dark-web-what-customers-should-do · Published 2026-11-12 · EpiFive ## Key takeaways - SBI disclosed on 21 October 2026 that its preliminary analysis of about 3.75 lakh records found on the dark web identified 3,897 customer records containing personal information. - According to SBI, the exposed fields reportedly included names, registered mobile numbers, dates of birth, gender, email and home addresses, branch and CIF identifiers, lead IDs and loan or lead metadata. - SBI said the authenticity, completeness, source and extent of the data were still being established, and it engaged a CERT-In-empanelled agency to investigate. - SBI says it never asks for OTP, user ID, password, PIN or CVV, so any caller who does is a fraudster, however much they know about you. - To block cards, net banking or UPI, call 1800 1234 or 1800 2100 and press 0; report fraud on 1930 or cybercrime.gov.in. State Bank of India told the stock exchanges on 21 October 2026 that a preliminary analysis of about 3.75 lakh records found on the dark web identified 3,897 customer records containing personal information, such as names, mobile numbers, dates of birth and addresses. SBI said the source, authenticity and full extent were still being established. If you bank with SBI, expect scam calls and messages that quote your real details, never share an OTP, PIN or password, and use SBI's official numbers to block and report anything suspicious. ## Who this guide is for This guide is for SBI account holders and borrowers, and for anyone helping a parent or relative who banks with SBI. It sets out what SBI has officially disclosed, what is still unknown, and the practical steps to protect your money and identity. EpiFive is not affiliated with SBI; every number below comes from SBI's own website, so you can check it yourself. ## What happened SBI made the disclosure in a filing to BSE and NSE under Regulation 30 of the SEBI listing rules, dated 21 October 2026 and titled "Incident involving Data Loss". In it, SBI said: - "the Bank has experienced an incident involving the loss of certain data." - On 16 October 2026 it received communications from its threat intelligence service provider, the Defence Cyber Agency and CERT-In about "the suspected exposure of the Bank's customer data on the dark web." - "During the preliminary analysis of approximately 375,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified." - "A detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank." - It activated its cyber incident response and containment protocols and engaged "an independent CERT-In-empanelled cybersecurity agency" to assess and investigate. - The incident "does not have any material impact on Bank's Core business operations, financial performance or business continuity." ### What data SBI says was involved According to the filing, the exposed information "reportedly included" these fields: | Field | Why it matters to you | | --- | --- | | Name, gender, date of birth | Lets a caller "confirm" your identity to you and sound official | | Registered mobile number and email address | The channels scammers will use to reach you | | Residential address | Can be used in courier, KYC or "verification visit" scams | | Branch and CIF identifiers | Your Customer Information File number and home branch, which make a fake "bank officer" sound genuine | | Lead IDs and loan or lead metadata | Details of loan applications or offers, useful for fake loan approval or EMI calls | The filing does not mention passwords, PINs, OTPs, card numbers or CVVs. It also does not say whether affected customers will be contacted individually. As of 12 November 2026, we found no later SBI exchange filing updating these figures. ## Am I affected? SBI has not published a way to check whether your record is among the 3,897, and it said its investigation into the source and extent was continuing. Treat yourself as possibly affected if you are an SBI customer, and particularly if you applied for or were offered an SBI loan, because the filing mentions "lead IDs" and "loan/lead records". The practical risk is social engineering. A fraudster who knows your name, CIF number, branch and the loan you enquired about can sound exactly like a bank employee. Knowing your details does not make a caller genuine. ## What to do now ### 1. Be suspicious of calls, SMS and WhatsApp messages that use your details Expect messages about "KYC expiry", a "blocked" YONO or net banking account, a "pre-approved loan" that needs a processing fee, reward points about to lapse, or an EMI problem. Do not click links, do not install apps or APK files sent in messages, and do not call numbers given in the message. See our guide to [spotting phishing SMS and email in India](https://www.epifive.com/blog/phishing-email-sms-how-to-spot-report-india) for common patterns. ### 2. Never share OTP, PIN, CVV or passwords SBI's contact centre page says "SBI does not ask for OTP and advises not to share with anybody." Its contact page says the bank never asks for "your user id / password / pin no. through phone call / SMSes / e-mails", and its cyber security page adds that the bank never asks for card numbers or CVV. Anyone who asks for these is a fraudster, even if they quote your CIF number. ### 3. Verify that a call is genuinely from SBI - Under a TRAI direction of 19 November 2025, commercial banks, including public sector banks, had to move their service and transactional calls to the 1600 number series by 1 January 2026. A caller who claims to be from SBI on an ordinary 10-digit mobile number is a red flag. - No matter which number calls you, end the call and ring SBI yourself on a number from its official website: **1800 1234** or **1800 2100** (also **1800 11 2211** and **1800 425 3800**, all toll free; **080-26599990** is the toll number). - Never trust a "customer care" number from a search ad, social media post or message. Our guide to the [fake customer care number scam](https://www.epifive.com/blog/fake-customer-care-number-scam-how-to-avoid) explains why. ### 4. Check your credit report for loans you did not take Personal details from a leak can be used in loan or credit card applications in your name. The RBI requires each credit information company to give you one free full credit report, including your credit score, once in every calendar year. Download your report from each bureau (TransUnion CIBIL, Experian, Equifax and CRIF High Mark) and look for accounts or enquiries you do not recognize. The RBI also requires bureaus to send an SMS or email alert when a lender accesses your report and the enquiry appears in it, so an unexpected alert deserves a follow-up. ### 5. Lock your Aadhaar biometrics if you do not use them UIDAI's free biometric lock blocks fingerprint, iris and face authentication on your Aadhaar. UIDAI says you need a registered mobile number, an OTP turns the lock on or off, and you can do it through the UIDAI website (myAadhaar) or the Aadhaar app. OTP-based authentication keeps working, and a temporary unlock lasts "generally 15 minutes" or one transaction. The UIDAI helpline is **1947**. ### 6. Turn on alerts and review your accounts Make sure SMS alerts reach your current mobile number, check your statement for debits you do not recognize, and review any standing instructions or UPI mandates you did not set up. ## If you have lost money or shared details Act immediately. Under RBI rules, how fast you report an unauthorised electronic transaction affects how much of the loss you may have to bear. 1. **Block access.** Call **1800 1234** or **1800 2100** and press **0** in the main menu for "Block ATM Card, INB & UPI", then choose ATM card block, internet banking block or UPI block. 2. **Report the transaction to SBI.** For unauthorised electronic transactions SBI lists **1800 11 1109** and **94491 12211** (toll free), and **080-2659 9990** (toll). 3. **Report the fraud.** Call **1930** or file a complaint on **cybercrime.gov.in**. SBI also asks customers to report cyber incidents to **report.phishing@sbi.co.in**. Keep transaction IDs, the caller's number and screenshots. 4. **Change credentials.** Change your YONO, internet banking and UPI PINs and passwords, and secure the email account linked to your bank. 5. **Escalate if needed.** If SBI does not resolve your complaint, you can complain to the RBI Ombudsman at **cms.rbi.org.in** (contact centre 14448). If your mobile number suddenly loses signal, your SIM may have been swapped: see [SIM swap fraud](https://www.epifive.com/blog/sim-swap-fraud-india-protect-yourself). If a caller threatens arrest on a video call, read about the [digital arrest scam](https://www.epifive.com/blog/digital-arrest-scam-india-what-to-do). ## How to protect yourself after any bank data leak - Assume anyone who knows your details may still be a fraudster. - Contact the bank only through numbers on its official website, app, passbook or statement. - Keep OTP, PIN, CVV and passwords private, always. - Check your credit report every year and after any breach. - Keep Aadhaar biometrics locked when you do not need them. - Report every attempt on 1930 or cybercrime.gov.in, even if you lost nothing. SBI's website is now at sbi.bank.in; when we checked, links on www.sbi.co.in redirected there. Treat any look-alike domain as fake. ## What we checked - Downloaded SBI's 21 October 2026 Regulation 30 filing ("Incident involving Data Loss") from bseindia.com on 2026-11-12 and quoted its wording directly; the 375,000 and 3,897 figures, the 16 October alert and the list of exposed fields come from that filing. - Searched for a later SBI exchange filing on the same incident and found none as of 2026-11-12. - Opened SBI's customer care contact page, Contact Centre page and Cyber Security page on sbi.bank.in for the toll-free numbers, the unauthorised-transaction numbers, the IVR "Press 0" blocking menu, report.phishing@sbi.co.in and the "does not ask for OTP" statement; the four toll-free numbers matched on two SBI pages. - Checked the PIB release of 19 November 2025 on TRAI's direction requiring commercial banks to adopt 1600-series numbers by 1 January 2026. - Checked UIDAI's authentication FAQ for the biometric lock rules and the 1947 helpline, the RBI Credit Information Companies Directions, 2025 for free annual reports and access alerts, cms.rbi.org.in for the Ombudsman contact centre, and the PIB release on 1930 and cybercrime.gov.in. - Not verified: who obtained the data, how it reached the dark web, and claims by individual sellers. SBI has not disclosed the source as of 2026-11-12, so this guide does not speculate about it. Last tested: 2026-11-12 ## Sources - State Bank of India, Disclosure under Regulation 30: Incident involving Data Loss, 21 October 2026, BSE: https://www.bseindia.com/xml-data/corpfiling/AttachLive/e16e3a1a-ee15-4971-977c-5f9f6aef1fb9.pdf - SBI, customer care contact page: https://sbi.bank.in/web/customer-care/contact-us - SBI, Contact Centre: https://sbi.bank.in/web/customer-care/contact-centre - SBI, Cyber Security: https://sbi.bank.in/web/personal-banking/cyber-security - PIB, TRAI direction on 1600-series numbers for BFSI entities, 19 November 2025: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2191647®=3&lang=1 - UIDAI, Authentication FAQs (Aadhaar lock and biometric lock): https://uidai.gov.in/en/authentication - RBI, Credit Information Companies Directions, 2025: https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=12926 - RBI, Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11040&Mode=0 - RBI Complaint Management System: https://cms.rbi.org.in - PIB, Ministry of Home Affairs, 28 July 2026 (1930 and cybercrime.gov.in): https://www.pib.gov.in/PressReleasePage.aspx?PRID=2290366®=3&lang=1 - National Cyber Crime Reporting Portal: https://cybercrime.gov.in ## Frequently asked questions ### Is my SBI account or money at risk because of the leak? SBI's 21 October 2026 filing lists names, mobile numbers, dates of birth, addresses, branch and CIF identifiers and loan or lead details. It does not mention passwords, PINs, OTPs or card numbers, and it says the incident has no material impact on core business operations. The main risk is scam calls and messages that use your real details to win your trust. ### How many SBI customers were affected? SBI said its preliminary analysis of about 3.75 lakh (375,000) records on the dark web identified 3,897 customer records containing personal information. It also said a detailed investigation was needed to establish the authenticity, completeness, source and extent of the exposed data, so the final number may differ. ### What is the SBI number to block my card, net banking or UPI? Call SBI's contact centre on 1800 1234 or 1800 2100 and press 0 in the main menu for "Block ATM Card, INB & UPI". To report an unauthorised electronic transaction, SBI lists 1800 11 1109 and 94491 12211, both toll free. ### Where do I report a phishing call or message pretending to be SBI? SBI asks customers to email report.phishing@sbi.co.in or call the national cyber crime helpline 1930. You can also file a complaint on cybercrime.gov.in, the Ministry of Home Affairs portal for online fraud.