INDIA’S DATA LEAK CRISIS: SBI IDENTIFIES 3,897 CUSTOMER RECORDS IN SUSPECTED DARK WEB EXPOSURE
A Special Investigative Report by Shoaib Pathan
New Delhi | October 21, 2026 India’s growing dependence on digital banking and online services has brought renewed attention to the security of personal information following a suspected data exposure involving the State Bank of India (SBI). In a disclosure reported on October 21, the country’s largest public-sector bank said a preliminary analysis of approximately 3.75 lakh records found online identified 3,897 customer records containing personally identifiable information (PII). The bank has initiated a detailed investigation to establish the authenticity, completeness and potential source of the information.
According to reporting by Reuters and other news organisations, SBI received alerts on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). The bank subsequently initiated its cyber incident response procedures and engaged an independent cybersecurity agency to assess the nature and extent of the suspected exposure. SBI stated that the incident was not expected to have a material impact on its core operations, financial performance or business continuity. However, the investigation remains important for determining the potential risks to individual customers.
The distinction between the two reported figures is essential. Approximately 3.75 lakh refers to the wider pool of records examined, while 3,897 refers to the customer records in which personal information was identified during the preliminary analysis. These figures should not be interpreted as proof that every record examined was genuine or that every person associated with the records suffered financial harm.
What Information Was Reportedly Exposed? The preliminary findings described in media reports included customer names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. The records also reportedly contained branch identifiers, Customer Information File (CIF) identifiers, lead identification numbers and metadata associated with loan applications and related records.
Such information can create risks when combined and misused. Criminals may use genuine personal details to make fraudulent calls, impersonate bank representatives or send convincing messages designed to obtain confidential information. Depending on the data involved, exposure may also increase the risk of identity misuse and targeted social engineering.
However, the publicly reported preliminary findings do not establish that customers’ passwords, PINs, OTPs or account balances were exposed. Nor do they establish that the identified records have already been used to commit fraud. Those questions require evidence from the ongoing investigation.
“Understanding the Dark Web” The internet is often described through three broad categories: the surface web, the deep web and the dark web.
The surface web includes publicly accessible websites, news portals and other pages indexed by search engines. The deep web consists of content that is not generally indexed for public searching, such as private banking dashboards, email accounts and restricted databases. Much of this information is legitimate and protected by authentication.
The dark web refers to a smaller part of the internet accessed through specialised privacy-focused networks. These networks have legitimate uses, including protecting privacy, but some services are also misused to distribute stolen credentials, personal information and confidential records.
When information is reportedly discovered on the dark web, its appearance alone does not establish how it was obtained. It may have originated from an intrusion, compromised credentials, a third-party service, an insecure database or an earlier incident. Investigators must establish the source and authenticity of the information before drawing conclusions.
In the SBI case, the precise origin and method of the suspected exposure have not been conclusively established in the publicly available findings. It would therefore be premature to attribute the incident to a particular individual, organisation or technical vulnerability.
India’s Cybersecurity Challenge: What Do Official Figures Show? The SBI incident comes amid a substantial increase in cybersecurity incidents recorded in India. According to the Ministry of Home Affairs, citing CERT-In figures in a government release dated March 24, 2026, the number of cybersecurity incidents recorded over five years was as follows:
- 2021: 14,02,809
- 2022: 13,91,457
- 2023: 15,92,917
- 2024: 20,41,360
- 2025: 29,44,248
The figures show that the number of incidents recorded in 2025 was more than double the 2021 total. They demonstrate the scale of the cybersecurity challenge facing the country as digital services continue to expand.
Nevertheless, these numbers cover different categories of cybersecurity incidents. They are not equivalent to the number of confirmed data breaches, stolen records or unique individuals affected. A single incident may involve many records, while other incidents may not involve the exposure of personal information at all.
The same government release reported that 86,420 cybercrime cases were registered in India in 2023, compared with 44,735 in 2019. These are police-registered cases and must be distinguished from the broader incident totals recorded by CERT-In.
The government has also stated that CERT-In does not maintain an estimate of the total financial losses accrued from all cybersecurity incidents. Consequently, assigning a single monetary value to India’s overall data-leak problem without a reliable, clearly defined source would be misleading.
Major Historical Cases and Reported Data Exposure
The SBI incident is not the first case to raise concerns about the handling of personal information in India. Previous incidents and allegations involving citizens’ identity details and digital services have highlighted the importance of distinguishing verified findings from claims that remain disputed or unconfirmed.
The 2023 Claim Involving 815 Million Indian Citizens
In October 2023, cybersecurity reporting described a dataset allegedly containing information relating to approximately 815 million Indian citizens. Reporting associated with cybersecurity firm Resecurity said a threat actor had offered the dataset for sale and that sample records had been examined.
The reported information included names, telephone numbers, addresses and identity-related details such as Aadhaar and passport information. The case attracted significant attention because of the potential scale and sensitivity of the information described.
However, the figure of 815 million represents the reported size of the claimed dataset, not an officially confirmed count of unique victims. The dataset’s origin, completeness and potential duplication must be considered when assessing the claim. It should not be presented as proof that 815 million separate individuals were definitively affected by a single confirmed breach.
The 2023 CoWIN Data Exposure Allegations
In June 2023, reports emerged that a Telegram bot was providing personal information associated with individuals registered for COVID-19 vaccination. The allegations raised questions about the possible exposure of mobile numbers and identity-related details.
The Union Health Ministry stated that the CoWIN platform had security safeguards and said that CERT-In had reviewed the matter. The government’s initial position was that the CoWIN application or database did not appear to have been directly breached. Officials also indicated that information accessed by the bot appeared to come from previously compromised or stolen data rather than a direct connection to the CoWIN database.
Independent reporting raised further questions about how the information had become accessible. The case therefore needs to be described as a reported data-exposure controversy, with both the government’s findings and the concerns raised by independent reporting acknowledged. It should not be presented as definitive proof that the CoWIN database itself was breached.
Aadhaar and PAN Information: Government Action in 2024.. On September 26, 2024, India’s Ministry of Electronics and Information Technology announced action against websites that were exposing sensitive personal information, including Aadhaar and PAN details.
According to the government’s statement, the websites were blocked after the issue was identified. The Unique Identification Authority of India also lodged a complaint with the relevant police authorities. CERT-In’s examination identified security flaws in the websites, and guidance was provided to address those weaknesses.
Unlike an unverified online allegation, this case is supported by a published government statement describing the action taken. It illustrates the privacy risks that arise when sensitive identity information is displayed or made accessible without appropriate safeguards.
These historical cases cannot simply be added together to calculate the number of Indians affected by data leaks. The datasets may overlap, the reported figures may use different definitions, and some claims remain subject to verification.
Why Financial Institutions Are Particularly Vulnerable.....
Banks and other financial institutions hold information that can connect a person’s identity with financial products, account-related identifiers and transactions. This makes their systems attractive targets for criminals seeking information that can support fraud or impersonation.
A suspected data exposure does not necessarily mean that the bank’s core transaction systems have been disrupted. Personal records can be exposed while ordinary services continue to operate. This distinction is particularly important in the SBI case, where the bank has stated that its core operations and financial performance have not been materially affected.
Potential consequences for individuals may include more convincing phishing attempts, impersonation calls, fraudulent loan-related communications and attempts to obtain confidential banking credentials. These are risks associated with the reported categories of information, not confirmation that such crimes have occurred as a result of this particular incident.
Protecting customers therefore requires more than maintaining uninterrupted banking operations. It also requires identifying the source of suspected exposure, securing affected systems, monitoring potential misuse and communicating appropriate guidance to customers.
Shoaib Pathan’s Independent Research and Fact-Check..
As part of this report, Shoaib Pathan reviewed publicly available news reports, official government releases and published cybersecurity research to examine the wider implications of data exposure and online privacy.
His research focuses on understanding how personal information can be exposed, how it may be misused and why digital privacy has become an increasingly important public concern. The study also examines the differences between the surface web, deep web and dark web, alongside the risks associated with phishing, identity misuse and financial cyber fraud.
Pathan’s approach emphasises the importance of distinguishing between preliminary findings, reported allegations and independently verified facts. In his assessment, the scale of a reported dataset alone is not sufficient to establish the number of victims or the financial damage caused. Such conclusions require reliable evidence about the information involved, its authenticity, the number of unique individuals affected and any resulting harm.
This report is based on publicly available sources. It does not claim that Pathan personally accessed or independently verified the underlying dark-web datasets. His research into cybersecurity, data protection and digital awareness is ongoing.
What Customers Can Do to Protect Themselves?
Customers should remain alert without assuming that every account has been compromised. They should never share OTPs, PINs or passwords with callers claiming to represent a bank. They should also be cautious of unexpected messages about loans, KYC updates, account verification or urgent security problems.
Customers can monitor transaction alerts, review account activity and contact their bank through official channels if they notice suspicious activity. If they suspect financial cyber fraud, they should report it promptly through the National Cyber Crime Reporting Portal at cybercrime.gov.in or call India’s cyber-fraud helpline at 1930.
These precautions are useful regardless of whether an individual’s records are ultimately confirmed as part of the SBI incident.
(Protecting Digital Trust).
The suspected SBI data exposure raises important questions about the security of customer information at a time when millions of Indians rely on digital banking and online services.
The bank’s preliminary analysis identified 3,897 customer records containing personal information among approximately 3.75 lakh records examined. The full extent and source of the suspected exposure remain matters for investigation, while SBI has stated that its core operations continue without a material impact.
India’s official cybersecurity statistics demonstrate the scale of the broader challenge, but they must not be confused with confirmed data breaches or individual victims. Historical cases involving identity information and digital platforms further show why allegations, official findings and independently verified evidence must be clearly distinguished.
The priority now is a transparent investigation, effective protection of potentially affected customers and stronger safeguards against future incidents. Ultimately, cybersecurity is not only about keeping digital systems operational; it is also about protecting personal information and maintaining public confidence in the services people depend on every day.
Report by Shoaib Pathan
Journalist | Independent Researcher
Reporting on Cybersecurity, Data Privacy and Digital Awareness
Sources and References
1. Reuters — SBI reports exposure involving nearly 3,900 customer records, October 21, 2026.
https://www.reuters.com/legal/litigation/state-bank-india-reports-cyberattack-involving-customer-records-2026-10-21/
2. The Economic Times — SBI flags suspected dark-web exposure of 3,897 customer records.
https://m.economictimes.com/industry/banking/finance/banking/sbi-flags-dark-web-exposure-of-3897-customer-records-names-mobile-numbers-addresses-among-data-leaked/articleshow/135081335.cms
3. Press Information Bureau, Ministry of Home Affairs — Assistance to States to Tackle Cyber Incidents, March 24, 2026.
https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2244504&lang=2®=48
4. Press Information Bureau, Ministry of Electronics and IT — Government action on websites exposing Aadhaar and PAN details, September 26, 2024.
https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2059179&lang=2®=48
5. Press Information Bureau, Ministry of Health and Family Welfare — CoWIN Data Breach statement, June 12, 2023.
https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=1931691&lang=2®=48
6. The Indian Express — Government response to CoWIN data exposure allegations, June 2023.
https://indianexpress.com/article/technology/tech-news-technology/rajeev-chandrasekhar-cowin-vaccine-data-breach-8659292/
7. TechTarget — Analysis of the reported 815 million-record Indian data exposure claim, October 2023.
https://www.techtarget.com/cybersecurity/feature/10-biggest-data-breaches-in-history-and-how-to-prevent-them
