Your Bank Details on the Dark Web? SBI Confirms Leak of 3,897 Customer Records

India’s largest public sector lender, the State Bank of India (SBI), has confirmed that 3,897 customer records containing sensitive personal information were found on the dark web, raising fresh concerns over the safety of banking data and the protection of customer privacy.

The bank received alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about customer information appearing online. Following the alerts, SBI identified 3,897 records containing personal details, including names, mobile numbers, email addresses, residential addresses and loan-related information.

The identified records form part of a much larger set of 3.75 lakh records currently under review. The bank has activated its incident-response protocols and engaged an independent cybersecurity firm to conduct a comprehensive assessment of the incident, examine the potential exposure of information and help establish the extent of the breach.

SBI has maintained that its core banking operations remain unaffected. However, the absence of disruption to banking services does not, by itself, resolve concerns about the possible misuse of exposed customer information.

Personal data available online can potentially be exploited for targeted phishing attacks, fraudulent calls, identity-related scams and attempts to trick customers into revealing banking credentials or one-time passwords. Loan-related information could also make fraudulent communications appear more convincing by allowing criminals to pose as bank representatives.

The incident has prompted calls from advocacy groups for direct notification to affected customers, enabling them to take precautions against potential fraud. Political criticism has also focused on the security safeguards maintained by the country’s largest public sector bank and the need for greater accountability when sensitive financial information is exposed.

As the independent assessment proceeds, key questions remain over how the information reached the dark web, whether the exposure is limited to the records already identified and whether additional customers may be affected.

For SBI customers, the incident is a reminder to remain alert to suspicious calls, messages and emails claiming to originate from the bank. Customers should never disclose passwords, PINs or OTPs, even when a caller appears to possess genuine personal or loan-related details.

The final assessment will be crucial in determining the full extent of the exposure and the steps needed to prevent similar incidents in the future.