Nearly four thousand State Bank of India customers have had their personal and loan information surface on the dark web, yet the bank's own regulatory filing says nothing about whether any of them have been told. SBI informed the BSE and the National Stock Exchange on 21 October 2026 that it had suffered what it called an "incident involving data loss." The filing is calibrated for investors, not for the people whose names, addresses and loan details are now in circulation.
What the filing says, and what it leaves out
SBI's Regulation 30 disclosure states that on 16 October the bank received alerts from its threat intelligence vendor, the Defence Cyber Agency and CERT-In about suspected exposure of customer data on the dark web. Of roughly 3.75 lakh records found there, a preliminary analysis identified 3,897 customer records containing names, mobile numbers, dates of birth, addresses, branch and CIF identifiers, and loan-related metadata. The bank has engaged a CERT-In empanelled agency to investigate and says there is no material impact on its core business operations or financial performance. That reassurance is addressed to shareholders. The filing does not confirm whether any customer notice has gone out, nor does it explain what the remaining records in the larger dataset contain. A threat actor had already claimed, in a public post three days before the filing, to have released 3.75 lakh rows of data alongside more than 2,700 documents linked to SBI, including loan applications and account opening forms. If those documents include identity and address proofs, the number of people genuinely affected could run well beyond the figure SBI has confirmed.
A regulatory gap that favours silence
India's data protection law does contain a provision requiring a company to notify each affected individual after a breach. Section 8(6) of the Digital Personal Data Protection Act, 2023, imposes exactly that duty. But under the government's staggered rollout, this provision does not take legal effect until May 2027. Until then, a bank's formal obligations run upward, to regulators, not downward, to customers. CERT-In's 2022 directions require incident reporting within six hours; the RBI's cyber security framework requires banks to file an initial report within two to six hours. A bank can satisfy both requirements in full and still leave every affected customer unaware that their data is exposed. The RBI tried to close this gap through an advisory rather than a binding rule. Its Department of Supervision issued Advisory No. 3/2026 in March, recommending that banks notify affected customers through SMS, email, app alerts and calls, with helpline support built into their crisis management plans. Being advisory, it carries no penalty for non-compliance, and SBI's filing gives no indication that this standard has been met.
Why notification is not a formality
The leaked fields matter because of how fraud calls are constructed. A caller who already knows your name, date of birth, branch and loan details sounds credible precisely because that information is supposed to be known only to your bank. Standard warnings against sharing an OTP assume a customer can distinguish a genuine bank official from an impostor. A data leak erodes that distinction, and only a direct warning from the bank restores it. This is not SBI's problem alone. Bank of Baroda opened a forensic investigation in July 2026 after a compromised employee email account exposed internal data, suggesting the vulnerability lies as much in operational practice, including vendors and direct selling agents who routinely handle lead and loan data, as in any single institution's defences.
What should follow
A formal representation has been sent to SBI's Chairman, with copies to the RBI Governor and CERT-In's Director General, asking the bank to notify every affected customer directly, set up a helpline to check exposure, disclose the full contents of the leaked dataset, and confirm whether customers who suffer financial loss will be compensated under existing RBI liability rules. The RBI has also been asked to make customer notification binding for all regulated entities ahead of the 2027 deadline. Until such disclosure becomes mandatory, bank customers remain dependent on their own caution. SBI customers should treat any call, SMS or message quoting personal or loan details with suspicion, report unauthorised transactions through the bank's helpline or cybercrime.gov.in, and ask directly whether their data forms part of the exposed records.