Mumbai: India's largest bank State Bank of India said on Wednesday that the bank's system experienced an "incident" on October 16, wherein 375,000 records containing customer data were exposed on the dark web.

According to information disclosed by the bank, about 3,75,000 customer records had been exposed on the dark web in the data breach. The bank informed in an exchange filing that it had "experienced an incident involving the loss of certain data." The disclosure stated that on 16 October 2026, it was informed by its Threat Intelligence Service Provider, the Defence Cyber Agency, as well as the government's Indian Computer Emergency Response Team (CERT-In), concerning the suspected exposure of the Bank’s customer data on the dark web.

SBI said during the preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information (PII) were identified. The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files.

SBI said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the Bank. The disclosure added that the bank "promptly activated its cyber incident response and containment protocols."

Additionally, an independent CERT-In-empanelled cybersecurity agency was engaged to conduct a comprehensive assessment and investigate the nature and extent of the alleged compromise. 

SBI said that the breach "does not have any material impact on Bank’s Core business operations, financial performance or business continuity." The bank’s core business functions continue to operate normally without disruptions. It added that a detailed assessment was currently underway and "appropriate remedial and preventive measures are being implemented as required."

This is not the first data security breach involving an Indian bank. In July this year, Bank of Baroda launched a forensic investigation after a dark web leak compromised roughly 1 terabyte of retail and corporate banking records, customer account files, and loan data. In 2016, approximately 3.2 million debit cards across major lenders (including SBI, ICICI, HDFC, YES Bank, and Axis Bank) were compromised via malware injected into Hitachi Payment Services’ ATM and POS infrastructure.