State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web

Past-week coverage · Original source published 2026-10-21.

State Bank of India has confirmed a data leak after identifying 3,897 customer records containing personal information inside a set of about 375,000 records offered on the dark web. The state-owned bank, India's largest, disclosed the incident in a stock-exchange filing dated October 21, saying it "has experienced an incident involving the loss of certain data."

The bank said it does not yet know where the data came from. That leaves the origin of the records unresolved, and it means the confirmed figure is a subset of a much larger collection rather than a count of everything circulating.

Why the gap matters

A bank confirming that customer records leaked is one thing. Knowing whether the data came from its own systems, a third party or an unrelated source is another, and the filing does not settle it. Until the source is established, the scope of exposure stays uncertain, and so does the question of who else may be affected.

What customers and defenders should watch

With personal information confirmed in circulation, the practical risks are identity theft and fraud that leans on accurate personal details. Customers should treat unexpected calls, messages or emails that quote their account or personal data with suspicion, and verify through official bank channels rather than contact details supplied by the caller. The bank has not, in the retained reporting, described notification plans or remediation steps, so those details remain open.

For other institutions, the case is a reminder that a dark web listing rarely maps cleanly onto one organization's records. Matching a sample against internal data can establish whether a leak is yours, but only if the matching is done carefully and the unmatched remainder is not assumed to be someone else's problem.