State Bank of India faces customer data leak on dark web involving thousands of records

UPDATE - follow-up to Data breach: SBI admits exposure of its customer data on the Dark Web: State Bank of India revealed that thousands of customer records containing private personal details were leaked online following a security alert received five days earlier from the Defence Cyber Agency, CERT-In, and its Threat Intelligence Service Provider.

Investigation and Findings

The country's biggest commercial lender stated that preliminary checks of roughly 3.75 lakh records found on the dark web pinpointed 3,897 specific customer files with Personally Identifiable Information. This compromised material included names, phone numbers, home addresses, dates of birth, email accounts, gender, branch details, lead identifiers, and file metadata linked to loans. Bank officials activated containment steps and hired an independent agency empanelled by CERT-In to review the breach, while confirming that daily business operations and financial results remain unaffected.

Criticism and Demands

The Internet Freedom Foundation criticized the lender for not detecting the incident itself and for waiting five days to file an exchange disclosure without giving direct warnings to the impacted individuals. The group warned that these customers face a high risk of targeted fraud calls from tricksters who know their banking particulars, and urged the bank to contact every affected person immediately in multiple languages. According to the Foundation, current laws require reporting to regulators rather than consumers because key notification rules under the Digital Personal Data Protection Act will only take effect in May 2027.

Context

Banks handle vast amounts of sensitive personal and financial records, making them frequent targets for cyber criminals seeking to exploit stolen details for financial fraud. When data leaks onto the dark web, public institutions typically rely on specialized cybersecurity audits and regulatory reporting protocols to contain the fallout. This event highlights the growing debate over how quickly organizations must notify everyday citizens when their private information is compromised.