SBI data leak: 'Customer balances are completely safe,' State Bank of India assures users

The State Bank of India (SBI) has assured customers that their money remains safe following a suspected data leak involving customer records found on the dark web.

In a post on X, the country's largest bank said the incident had affected a “very very small number of customers” and had not materially impacted its IT systems or core business operations.

“Customer balances are completely safe and we are taking all possible steps to protect the interests of our valued customers,” SBI said in its post, titled Important Information for Customers.

The bank also reiterated that protecting customers' financial assets, personal data and trust remained its highest priorities.

SBI says data leak affected ‘very very small number of customers’. In its post on X, SBI said the suspected cyber incident had not materially affected its IT infrastructure, core business operations, financial performance or business continuity.

“We reiterate that safety of our customers' financial assets, data and their trust in us remain our highest priorities,” the bank said.

The assurance comes as SBI investigates the suspected exposure of customer information on the dark web.

3,897 customer records identified in preliminary analysis

The exposed information reportedly included customers' names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. Other details included branch information, Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan and lead records.

The bank said a detailed investigation was needed to establish the authenticity and completeness of the exposed data, identify its potential source and assess the risks to customers and the bank.

SBI activates cyber incident response measures

SBI said it had received alerts about the suspected exposure on October 16 from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In).

The bank said it promptly activated its cyber incident response and containment protocols and engaged an independent cybersecurity agency empanelled by CERT-In to conduct a comprehensive assessment and investigate the suspected compromise.

The lender added that the incident had no material impact on its financial performance or business continuity and that its core business functions continued to operate normally.

What should SBI customers do?

Customers should remain alert to suspicious calls, emails and messages claiming to be from the bank. They should never share their OTPs, ATM PINs or internet banking passwords, and should verify requests for KYC updates through official SBI channels.

Anyone who notices an unauthorised transaction should contact the bank immediately. Suspected cyber fraud can also be reported through India's cybercrime helpline at 1930 or the National Cyber Crime Reporting Portal.