Nearly four thousand State Bank of India customers have had their names, dates of birth, home addresses and loan details surface on the dark web, yet none appears to have been told so by the bank itself. SBI confirmed the exposure in a regulatory filing to the BSE and NSE on 21 October 2026, five days after it first learned of the breach. The filing satisfies securities law. It does little for the people whose personal data is now circulating outside the bank's control.
A disclosure built for investors, not customers
The filing, made under Regulation 30 of SEBI's Listing Obligations and Disclosure Requirements, describes an "Incident involving Data Loss" detected on 16 October through alerts from a threat intelligence vendor, the Defence Cyber Agency and CERT-In. SBI says a preliminary review of roughly 3.75 lakh records found online identified 3,897 customer records containing personally identifiable information, including mobile numbers, dates of birth, addresses, CIF identifiers and loan-related metadata. The bank states the incident has no material impact on its core operations. That reassurance is aimed squarely at shareholders. Regulation 30 exists to keep markets informed of events that could move a stock, not to protect the individuals whose data has leaked. SBI's filing does what the rule requires. It stops well short of what affected customers need.
Why the gap between disclosure and notice matters
Banking fraud in India increasingly relies on impersonation, where callers who already possess a customer's name, date of birth, branch and loan details sound entirely credible as bank officials. The standard warning never to share an OTP assumes customers can distinguish a genuine bank call from a fraudulent one. Leaked data undermines that assumption directly. Only a direct notice from SBI allows the 3,897 identified customers, and potentially many more among the wider 3.75 lakh records and 2,722 documents the alleged leak also includes, to recognise the risk and respond before money moves.
A regulatory gap the law has not yet closed
India's Digital Personal Data Protection Act, 2023 would require SBI to notify both the Data Protection Board and every affected customer under Section 8(6). That provision, along with the detailed procedure in Rule 7 of the DPDP Rules, 2025, does not take effect until May 2027 under the government's staggered commencement schedule. Until then, breach-reporting obligations run mainly to regulators: CERT-In's 2022 Directions require reporting within six hours, and the RBI's cyber security framework for banks sets a similarly short window for alerting the central bank. Neither requires telling the customer. The RBI did go further in March 2026, issuing an advisory recommending that banks notify affected customers through SMS, email, calls and app alerts as part of their crisis management plans. That advisory is not binding, and SBI's filing gives no indication it has been followed.
What should happen next
A representation has been sent to SBI's Chairman, with copies to the RBI Governor and the Director General of CERT-In, asking the bank to notify every affected customer directly, disclose the full scope of the leaked data, explain how it left the bank's systems, and confirm that any resulting financial loss will be compensated under existing RBI liability rules. The RBI has also been asked to make customer notification mandatory for regulated entities ahead of the DPDP Act's commencement, rather than leaving it to voluntary best practice.
- SBI customers should treat calls, SMS or WhatsApp messages citing personal or loan details with suspicion.
- SBI has stated it never asks for OTPs, passwords, PINs or user IDs over the phone.
- Unauthorised transactions can be reported to SBI on 1800 1111 09 or via email, and to the national cyber crime helpline on 1930 or cybercrime.gov.in.
Until SBI or the regulators say otherwise, customers have no official way of knowing whether their own records are among those already circulating. That silence, more than the breach itself, is what deserves scrutiny.