SBI Data Leak: What We Know, What We Do Not, and What Customers Should Do
Introduction
India's largest lender is dealing with a serious data security scare. On October 21, 2026, the State Bank of India told the stock exchanges that it "has experienced an incident involving the loss of certain data" after customer records linked to the bank surfaced on the dark web, as The Hacker News reported. The bank says its core systems and customer funds are safe. Here is a clear look at what has been confirmed, what remains unknown, and what you can do right now.
How the leak came to light
The first event was on October 16. According to a hacker group called Siriusim, they put out the message on Breach Forums – a hacker group forum that specialises in sharing stolen data – claiming to have 375,000 customer records and 2,722 PDF files stolen from the State Bank of India (SBI).
On the same day, SBI received alerts from its threat intelligence provider, Defence Cyber Agency, and Cert-In (India's computer emergency response team) as per the Business Standard. This was followed by SBI submitting a disclosure to the BSE (Bombay Stock Exchange) and the NSE (National Stock Exchange) on October 21, under SEBI (Securities and Exchange Board of India) listing obligations, as per Money Life and Business Today.
What data was exposed
After a preliminary review of roughly 375,000 records circulating online, SBI identified 3,897 customer records containing personally identifiable information. The Free Press Journal reports that the exposed details include names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses and branch details. The records also carry banking metadata such as customer information file numbers, lead IDs and information tied to loan applications and related files.
The difference between the two headline numbers matters. The 375,000 figure is the size of the dataset on offer, while 3,897 is the number of records the bank has so far found to hold real customer information. The Hacker News notes that the count is preliminary and that the bank has yet to establish whether the data is authentic or how far the exposure goes. Reports of the filing do not mention the 2,722 PDF documents the seller advertised, so that claim remains unverified.
What SBI has said
SBI says that it implemented its cyber incident response and containment process based on the alerts received. The bank has also engaged an independent cybersecurity agency (empanelled by CERT-In) to assess the extent and the nature of the breach. "From a business point of view, the bank has informed investors that it does not expect any material impact on the financials of the bank or on business continuity.
Customer funds or core banking transactions have not been impacted," the bank said, as per the Free Press Journal.
The customer notification debate
Banks often argue that data should be verified before customers are alerted, and SBI's investigation is still at a preliminary stage. Still, customers cannot protect themselves against a risk they have not been told about, and the gap between regulatory duty and customer interest is exactly what this episode has exposed.
Why it matters
For the 3,897 people identified so far, the main danger is probably not the loss of money directly from their accounts but targeted fraud. Scammers who know a person's name, phone number, address and loan history can sound very convincing when they pose as bank staff.
SBI has faced scrutiny of this kind before. In 2019, TechCrunch reported that an unprotected server in an SBI data centre in Mumbai had exposed two months of data from SBI Quick, a text message and call-based service, putting account information of millions of customers within reach of anyone who finds it.
What customers can do now
SBI has not issued customer-specific guidance beyond its public notice, so the following are general precautions that apply to any data exposure of this kind.
- Any suspicious communication, such as a call, SMS or WhatsApp message, claiming to be from SBI, should be treated as suspicious, especially if it talks about a loan, creates an urgency to act or asks you to click on a link.
- Do not share your OTP, PIN, CVV or online banking password with anyone, even if you are talking to a bank executive, since the bank staff will not ask for these details.
- Switch on the transaction alerts and regularly check your bank account statement, and report any unauthorised transactions to the bank and file a complaint through the national cybercrime portal or helpline 1930.
- To determine whether a person is impacted, call SBI at the numbers and through the modes listed on its official website or on your bank card or passbook.
Conclusion
This story is still developing, and the numbers may change as the independent investigation progresses. For now, the confirmed facts are narrower than the hacker's claims, and the bank's financial position is not in question. What remains in doubt is where the data came from, how fresh it is, and whether the bank will warn the people it affects. Watch for the independent agency's findings and whether SBI notifies customers directly.
Sources
- The Hacker News: State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
- Business Standard: From SBI to ICICI, Major Banking Data Breaches and Cyberattacks in India
- Business Today: 3.75 lakh records, 3,897 customers, SBI says address, mobile numbers, email ID leaked
- Moneylife: SBI Data Leak, 3,897 Customer Records Found in Preliminary Analysis, IFF Says Customers Not Informed
- Internet Freedom Foundation: SBI told investors its data breach does not matter. What about the 3,897 customers it affected?
- YourStory: SBI finds 3,897 customer records on dark web after hacker's claim
- Free Press Journal: SBI Data Leak, Names, Phone Numbers, Addresses of Nearly 3,900 Customers Exposed
- TechCrunch: India's largest bank SBI leaked account data on millions of customers
Related Blogs
Introduction
There is a rising desire for artificial intelligence (AI) laws that limit threats to public safety and protect human rights while allowing for a flexible and inventive setting. Most AI policies prioritize the use of AI for the public good. The most compelling reason for AI innovation as a valid goal of public policy is its promise to enhance people's lives by assisting in the resolution of some of the world's most difficult difficulties and inefficiencies and to emerge as a transformational technology, similar to mobile computing. This blog explores the complex interplay between AI and internet governance from an Indian standpoint, examining the challenges, opportunities, and the necessity for a well-balanced approach.
Understanding Internet Governance
Before delving into an examination of their connection, let's establish a comprehensive grasp of Internet Governance. This entails the regulations, guidelines, and criteria that influence the global operation and management of the Internet. With the internet being a shared resource, governance becomes crucial to ensure its accessibility, security, and equitable distribution of benefits.
The Indian Digital Revolution
India has witnessed an unprecedented digital revolution, with a massive surge in internet users and a burgeoning tech ecosystem. The government's Digital India initiative has played a crucial role in fostering a technology-driven environment, making technology accessible to even the remotest corners of the country. As AI applications become increasingly integrated into various sectors, the need for a comprehensive framework to govern these technologies becomes apparent.
AI and Internet Governance Nexus
The intersection of AI and Internet governance raises several critical questions. How should data, the lifeblood of AI, be governed? What role does privacy play in the era of AI-driven applications? How can India strike a balance between fostering innovation and safeguarding against potential risks associated with AI?
- AI's Role in Internet Governance:
Artificial Intelligence has emerged as a powerful force shaping the dynamics of the internet. From content moderation and cybersecurity to data analysis and personalized user experiences, AI plays a pivotal role in enhancing the efficiency and effectiveness of Internet governance mechanisms. Automated systems powered by AI algorithms are deployed to detect and respond to emerging threats, ensuring a safer online environment.
A comprehensive strategy for managing the interaction between AI and the internet is required to stimulate innovation while limiting hazards. Multistakeholder models including input from governments, industry, academia, and civil society are gaining appeal as viable tools for developing comprehensive and extensive governance frameworks.
The usefulness of multistakeholder governance stems from its adaptability and flexibility in requiring collaboration from players with a possible stake in an issue. Though flawed, this approach allows for flaws that may be remedied using knowledge-building pieces. As AI advances, this trait will become increasingly important in ensuring that all conceivable aspects are covered.
The Need for Adaptive Regulations
While AI's potential for good is essentially endless, so is its potential for damage - whether intentional or unintentional. The technology's highly disruptive nature needs a strong, human-led governance framework and rules that ensure it may be used in a positive and responsible manner. The fast emergence of GenAI, in particular, emphasizes the critical need for strong frameworks. Concerns about the usage of GenAI may enhance efforts to solve issues around digital governance and hasten the formation of risk management measures.
Several AI governance frameworks have been published throughout the world in recent years, with the goal of offering high-level guidelines for safe and trustworthy AI development. The OECD's "Principles on Artificial Intelligence" (OECD, 2019), the EU's "Ethics Guidelines for Trustworthy AI" (EU, 2019), and UNESCO's "Recommendations on the Ethics of Artificial Intelligence" (UNESCO, 2021) are among the multinational organizations that have released their own principles. However, the advancement of GenAI has resulted in additional recommendations, such as the OECD's newly released "G7 Hiroshima Process on Generative Artificial Intelligence" (OECD, 2023).
Several guidance documents and voluntary frameworks have emerged at the national level in recent years, including the "AI Risk Management Framework" from the United States National Institute of Standards and Technology (NIST), a voluntary guidance published in January 2023, and the White House's "Blueprint for an AI Bill of Rights," a set of high-level principles published in October 2022 (The White House, 2022). These voluntary policies and frameworks are frequently used as guidelines by regulators and policymakers all around the world. More than 60 nations in the Americas, Africa, Asia, and Europe had issued national AI strategies as of 2023 (Stanford University).
Conclusion
Monitoring AI will be one of the most daunting tasks confronting the international community in the next centuries. As vital as the need to govern AI is the need to regulate it appropriately. Current AI policy debates too often fall into a false dichotomy of progress versus doom (or geopolitical and economic benefits versus risk mitigation). Instead of thinking creatively, solutions all too often resemble paradigms for yesterday's problems. It is imperative that we foster a relationship that prioritizes innovation, ethical considerations, and inclusivity. Striking the right balance will empower us to harness the full potential of AI within the boundaries of responsible and transparent Internet Governance, ensuring a digital future that is secure, equitable, and beneficial for all.
References
- The Key Policy Frameworks Governing AI in India - Access Partnership
- AI in e-governance: A potential opportunity for India (indiaai.gov.in)
- India and the Artificial Intelligence Revolution - Carnegie India - Carnegie Endowment for International Peace
- Rise of AI in the Indian Economy (indiaai.gov.in)
- The OECD Artificial Intelligence Policy Observatory - OECD.AI
- Artificial Intelligence | UNESCO
- Artificial intelligence | NIST
Executive Summary:
A social media viral post claims to show a mosque being set on fire in India, contributing to growing communal tensions and misinformation. However, a detailed fact-check has revealed that the footage actually comes from Indonesia. The spread of such misleading content can dangerously escalate social unrest, making it crucial to rely on verified facts to prevent further division and harm.
Claim:
The viral video claims to show a mosque being set on fire in India, suggesting it is linked to communal violence.
Fact Check
The investigation revealed that the video was originally posted on 8th December 2024. A reverse image search allowed us to trace the source and confirm that the footage is not linked to any recent incidents. The original post, written in Indonesian, explained that the fire took place at the Central Market in Luwuk, Banggai, Indonesia, not in India.
Conclusion: The viral claim that a mosque was set on fire in India isn’t True. The video is actually from Indonesia and has been intentionally misrepresented to circulate false information. This event underscores the need to verify information before spreading it. Misinformation can spread quickly and cause harm. By taking the time to check facts and rely on credible sources, we can prevent false information from escalating and protect harmony in our communities.
- Claim: The video shows a mosque set on fire in India
- Claimed On: Social Media
- Fact Check: False and Misleading
Executive Summary:
A widely circulated video claiming to feature a poster with the words "I Told Modi" has gone viral, improperly connecting it to the April 2025 Pahalgam attack, in which terrorists killed 26 civilians. The altered Marvel Studios clip is allegedly a mockery of Operation Sindoor, the counterterrorism operation India initiated in response to the attack. This misinformation emphasizes how crucial it is to confirm information before sharing it online by disseminating misleading propaganda and drawing attention away from real events.
Claim:
A man can be seen changing a poster that says "Tell Modi" to one that says "I Told Modi" in a widely shared viral video. This video allegedly makes reference to Operation Sindoor in India, which was started in reaction to the Pahalgam terrorist attack on April 22, 2025, in which militants connected to The Resistance Front (TRF) killed 26 civilians.
Fact check:
Further research, we found the original post from Marvel Studios' official X handle, confirming that the circulating video has been altered using AI and does not reflect the authentic content.
By using Hive Moderation to detect AI manipulation in the video, we have determined that this video has been modified with AI-generated content, presenting false or misleading information that does not reflect real events.
Furthermore, we found a Hindustan Times article discussing the mysterious reveal involving Hollywood actor Sebastian Stan.
Conclusion:
It is untrue to say that the "I Told Modi" poster is a component of a public demonstration. The text has been digitally changed to deceive viewers, and the video is manipulated footage from a Marvel film. The content should be ignored as it has been identified as false information.
- Claim: Viral social media posts confirm a Pakistani military attack on India.
- Claimed On: Social Media
- Fact Check: False and Misleading
