State Bank of India confirmed on October 21, 2026 that a cyberattack exposed 3,897 customer records on the dark web. The records include names, mobile numbers, and home addresses. The disclosure follows an earlier unverified claim by a threat actor named “Siriusim” on BreachForums, who alleged 3.75 lakh (375,000) records and 2,722 PDF documents , including KYC and loan application data. SBI’s official disclosure refers to the 3,897 figure. The investigation is ongoing.
Two Claims, One Bank, One Week
The SBI dark web story has two distinct layers, and it helps to understand both.
The first layer surfaced on October 16, 2026. A cybersecurity monitoring account, CyberPulse56, flagged a post on BreachForums from a threat actor using the name Siriusim. The claim: 3.75 lakh (375,000) customer records and 2,722 PDF documents allegedly linked to SBI and its subsidiaries, posted as what Siriusim called the first disclosure of the dataset.
Siriusim published four sample records publicly on the forum to demonstrate the data was genuine. An investigation by the Free Press Journal found that the phone numbers in those samples were valid. The data in the samples included names, dates of birth, mobile numbers, email addresses, residential details, occupation, nominee information, and bank branch details. The broader claimed dataset reportedly includes KYC documents, loan applications, account-opening forms, and potentially Aadhaar numbers.
India Today contacted SBI for comment by October 19. SBI had not responded.
Then, on October 21, SBI issued its own official disclosure, acknowledging 3,897 customer records. This is the confirmed figure SBI has stood behind. Whether the 3,897 records are a verified subset of Siriusim’s larger claim, a separate incident, or something connected to the PDF documents is not yet publicly clarified.
What is clear: SBI itself confirmed the exposure. That matters.
Why Names, Mobile Numbers, and Addresses Are Enough to Cause Real Harm
The data type confirmed by SBI names, mobile numbers, and addresses, sounds limited compared to the fears around banking data exposure, No account numbers, no passwords, no card details in what SBI has confirmed.
But in India’s digital payments landscape, this combination is dangerous enough on its own.
Mobile numbers are the backbone of UPI authentication. They’re linked to bank accounts, Aadhaar, and SIM cards. A criminal with your name, mobile number, and residential address has the raw material for a convincing bank impersonation call. They know who you are, where you live, and how to reach you. Add a reference to your local branch or the fact that you hold a specific loan product, and the call sounds legitimate to most people.
SIM swap fraud, where an attacker convinces your mobile carrier to transfer your number to a new SIM, is the downstream risk that makes this particularly serious. With your number transferred, every OTP sent for UPI transactions, net banking logins, and two-factor authentication goes to the attacker, not you.
This is the same risk we flagged when ValueFirst, the Indian CPaaS provider routing banking OTPs for millions of users, appeared in a dark web alert in September. Name, mobile, and context data feeds directly into the social engineering layer that makes SIM swap and vishing attacks work.
The KYC and Aadhaar Layer Makes It Worse
SBI’s official disclosure covers the 3,897 records. The broader Siriusim claim includes something more alarming: KYC documents and potentially Aadhaar numbers.
Aadhaar cannot be changed like a password. It is biometric and permanent. An Aadhaar number combined with a name, photo, and address is a complete identity document and once it’s in criminal circulation, it stays there. As we covered in detail in the Bank of Baroda breach, where eKYC records, Aadhaar numbers, and PAN card copies were part of a 1TB dark web dump, this is the category of data that makes a breach qualitatively different from a leaked email list.
SBI has not confirmed whether KYC or Aadhaar documents are part of its specific 3,897-record disclosure. If Siriusim’s broader dataset is connected to SBI’s official incident, that question becomes critical.
SBI’s Official Disclosure Is Itself Notable
The fact that SBI issued an official statement confirming the breach matters beyond the specifics of what was exposed.
Indian banks have historically been slow to confirm cybersecurity incidents publicly. The Bank of Baroda case saw a gap of days between the threat actor’s listing and the bank’s official response. CERT-In mandates a six-hour reporting window for confirmed incidents, a requirement that not every institution has met in 2026.
SBI’s disclosure on the same day Reuters confirmed the story suggests the bank acted quickly once the scope was established. India’s Digital Personal Data Protection (DPDP) Act 2023, whose breach notification provisions come fully into force in May 2027 , is creating institutional incentive to move faster on these disclosures. SBI may be setting a standard that other Indian banks will be expected to follow.
The Pattern of Indian Banking Data on the Dark Web
SBI’s October 21 disclosure doesn’t exist in isolation. Indian banking data has been appearing in dark web listings with increasing frequency through 2026.
The Bank of Baroda breach in July 2026 exposed KYC records, Aadhaar numbers, and employee data through a compromised email account, disclosed by the TripleX ransomware group. The ValueFirst dark web alert in September flagged a messaging platform that routes banking OTPs for major Indian financial institutions. The CRIF Cyber Observatory found that 2.5 billion records circulated on the dark web in H1 2026 alone, with India’s infostealer exposure ranking among the highest in the world.
India’s combination of rapid digital payments adoption, large volumes of KYC data required for financial services, and a growing concentration of critical data at major public sector banks makes it an attractive target for criminal data collection.
What SBI Customers Should Do Right Now
Whether your record is among the 3,897 confirmed by SBI, the larger Siriusim dataset, or neither, the practical response is the same.
Be suspicious of any call, text, or email referencing your SBI account. Anyone who knows your name, mobile number, branch, and approximate residential area can construct a convincing impersonation. Knowing your details does not make the caller legitimate. If you receive a call from someone claiming to be SBI, hang up and call SBI’s official customer care at 1800-11-2211 directly.
Lock your Aadhaar biometric authentication at myaadhaar.uidai.gov.in as a precautionary step if you’re concerned your KYC documents may have been included.
Enable transaction alerts for all SBI accounts so you get real-time notifications of any transfers or changes.
Report suspicious activity to India’s National Cyber Crime Reporting Portal at cybercrime.gov.in or call the 1930 helpline. If you believe your data has been misused, file a report early, it becomes relevant documentation if disputes arise later.
For the full checklist on what to do when your personal data appears on the dark web, our dark web data exposure guide covers each step in order.
Frequently Asked Questions
How many SBI customer records were exposed?
SBI officially confirmed 3,897 customer records containing personally identifiable information appeared on the dark web. A separate unverified claim by a threat actor named Siriusim on BreachForums alleged 3.75 lakh (375,000) records and 2,722 PDF documents.
What data was in the exposed records?
SBI’s confirmed disclosure covers names, mobile numbers, and addresses. The broader Siriusim claim also alleged KYC documents, loan applications, Aadhaar numbers, and account-opening forms.
Has SBI confirmed its systems were directly hacked?
SBI reported a cyberattack causing the exposure. It has not specified the exact attack vector or whether the breach originated within its own systems or through a third party.
Is my SBI account directly at risk?
Account passwords and transaction credentials are not confirmed as part of the disclosed data. The risk is from phishing, SIM swap, and social engineering attacks enabled by the personal details exposed.
What should I do?
Watch for unsolicited contact referencing your SBI account, enable Aadhaar biometric lock as a precaution, turn on account alerts, and report suspicious activity to cybercrime.gov.in or call 1930.
