State Bank of India disclosed a dark web data breach on 21 October 2026 after receiving warnings from CERT-In and the Defence Cyber Agency. Preliminary analysis of 3,75,000 leaked records revealed that 3,897 customer profiles containing personally identifiable information were compromised, including mobile numbers, residential addresses, dates of birth, and loan metadata.
Threat group Siriusim allegedly released the records alongside 2,722 PDF documents containing account applications. This breach exposes affected account holders to targeted financial impersonation scams. SBI insisted core operations remain uncompromised. The Internet Freedom Foundation criticized the five-day delay between threat notifications and regulatory disclosures to stock exchanges. Financial institutions face structural reporting gaps. Under current CERT-In 2022 guidelines and Reserve Bank of India frameworks, entities must notify regulators rather than affected individuals. Statutory provisions under Section 8(6) of the Digital Personal Data Protection Act 2023 requiring direct customer notification do not take effect until 13 May 2027.