SBI confirmed 3,897 customer records were found on the dark web after reviewing roughly 375,000 records posted by a threat actor group called Siriusim. Exposed data includes names, mobile numbers, dates of birth, home addresses, email addresses, CIF IDs, and loan-related metadata. No passwords, PINs, or OTPs were included. The BJD has demanded a transparent probe and strict action against SBI officials in Odisha. Affected customers should be on high alert for phishing calls and loan-related fraud.
What SBI Actually Confirmed
SBI filed a formal Regulation 30 notice with the stock exchanges on October 21–22, 2026 , the mandatory regulatory disclosure for listed companies when a significant event occurs. The bank stated that it had received alerts from its Threat Intelligence Service Provider, CERT-In, and the Defence Cyber Agency about a suspected data exposure earlier that week.
During a preliminary review of approximately 375,000 records available on the dark web, SBI identified 3,897 records containing Personally Identifiable Information (PII) of its customers. The broader dataset , 375,000 rows in CSV format and around 2,722 PDF documents including loan applications and account-opening forms ,was posted online by a threat actor group calling itself Siriusim.
SBI was careful to note that not all 375,000 entries contain confirmed personal information about an equivalent number of customers. The 3,897 figure is what the bank’s analysis specifically confirmed.
Crucially, SBI said no passwords, PINs, or OTPs were part of the exposed data. That’s a meaningful boundary. But it doesn’t mean affected customers are safe.
What Data Was Exposed
The 3,897 confirmed records contain the following categories of information:
- Full names
- Registered mobile numbers
- Dates of birth
- Email addresses
- Home addresses
- Branch details
- CIF (Customer Information File) identifiers
- Lead IDs and loan-related metadata
The CIF detail is the one that matters most for understanding the fraud risk. A CIF number is the unique identifier SBI assigns to a customer across all their accounts and products. Combined with a name, mobile number, date of birth, home address, and loan details, a fraudster has a complete package to impersonate an SBI official convincingly over the phone.
A caller who already knows your name, the branch you bank at, your date of birth, your home address, and that you have a specific loan , that caller is almost impossible to dismiss as a scammer. This is exactly how targeted vishing (voice phishing) attacks work. The scammer doesn’t guess. They already know your details.
As we’ve covered when looking at how CPaaS providers and banking platforms create specific fraud risks in India, OTP-routing and identity data together create layered fraud opportunities that go well beyond a simple phishing email. The SBI exposure creates similar conditions.
Where the Data Came From , Still Unknown
One significant detail that hasn’t been resolved: nobody has confirmed where the data actually originated. SBI has not established whether the 3,897 confirmed records came from its own internal systems, a subsidiary, or a third-party vendor.
This matters for understanding the risk to unaffected customers. If the breach was through a vendor with access to SBI customer records , rather than SBI’s core banking systems directly , the scope of who might be at risk could extend beyond the 3,897 confirmed figures.
The Siriusim group’s claim of 375,000 records is much larger than what SBI’s analysis confirmed. This gap could mean that most of those records are outdated, fabricated, or belong to people who aren’t SBI customers. But it could also mean SBI’s initial analysis isn’t complete.
This situation mirrors the pattern we’ve seen repeatedly in 2026 ,as covered in our piece on how supply chain vulnerabilities create data exposure that organizations only discover weeks later.
BJD’s Two-Part Condemnation
The political response came swiftly. On October 31, 2026, BJD Media Coordinator Dr. Lenin Mohanty issued a statement condemning SBI on two separate but related grounds.
The first is digital. Dr. Mohanty questioned why India’s largest public sector bank failed to detect a cybersecurity breach involving nearly 4,000 customers internally , and only learned about it through CERT-In and the Defence Cyber Agency. He called on SBI to publish a full, accurate list of all affected customers.
The second is physical. Dr. Mohanty alleged that SBI employees across Odisha have been demanding cash payments from customers for routine banking services , including cash withdrawals, loan processing, and insurance claim settlements. He called for strict disciplinary action against officials found to be accepting bribes.
“The negligence of a public sector bank towards its customers is condemnable,” he said.
These two issues are distinct, but together they paint a picture of systemic breakdown that goes beyond one cybersecurity incident.
The Customer Notification Problem
One of the more troubling elements of this breach is how SBI chose to notify affected customers. The bank filed its Regulation 30 notice , intended primarily for investors before directly contacting the 3,897 people whose data was confirmed on the dark web., The Internet Freedom Foundation (IFF) noted that affected customers were only notified via WhatsApp after external pressure was applied.
Compare this to what best practice looks like. A bank that identifies 3,897 specific customers whose mobile numbers, addresses, and loan details are on the dark web should proactively call and notify each person , not send a WhatsApp message after an NGO pushes for action.
This is especially critical because the India’s DPDP Act 2023 breach notification provisions , which would impose stricter mandatory notification timelines ,are not yet fully in force. The legal gap left affected customers waiting for clarity they should have received immediately.
What SBI Customers Should Do
If you’re an SBI customer , whether your records are confirmed in the 3,897 or not , the right response now is heightened caution.
Treat any inbound SBI-related call with suspicion. If someone calls referencing your branch, loan details, account number, or personal information to “verify” your identity, hang up. Call SBI’s official customer care number 1800-11-2211 directly.
Never share your OTP, PIN, or internet banking password. These were not in the breach, which means any caller asking for them is definitely running a fraud, not a legitimate SBI verification.
Watch your SMS and email for loan-related outreach you didn’t initiate. Lead ID and loan metadata in the breach makes customers specifically vulnerable to fraudulent loan offers or processing-fee scams.
File a complaint if you suspect misuse. Report it to the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the national helpline on 1930.
For a step-by-step guide on what to do when your banking data may have been exposed, our complete dark web data exposure guide covers the full checklist.
Frequently Asked Questions
Has SBI confirmed this breach?
Yes. SBI filed a Regulation 30 notice on October 21–22, 2026, confirming 3,897 customer records containing PII were found on the dark web.
What data was leaked?
Names, mobile numbers, dates of birth, email addresses, home addresses, branch details, CIF identifiers, lead IDs, and loan-related metadata. No passwords, PINs, or OTPs.
Who is the threat actor?
A group calling itself Siriusim, which claimed to have 375,000 SBI-related records.
Why is BJD involved?
BJD is the main opposition party in Odisha. They have demanded an investigation into the breach and also raised separate allegations of SBI employee corruption in the state.
What should affected SBI customers do?
Be suspicious of inbound banking calls that quote your personal details, never share OTPs or passwords, and report any suspected fraud to cybercrime.gov.in or call 1930.
Was SBI’s own system hacked?
SBI has not confirmed the source. The data may have come from SBI’s own systems, a subsidiary, or a third-party vendor. The investigation is ongoing.