SBI Data Leak: What Is Dark Web & Who All Can Access It?

State Bank of India (SBI) is investigating reports that nearly 3.75 lakh customer records allegedly linked to the bank surfaced on the dark web, with 3,897 records containing personal information identified in a preliminary review. The incident has raised urgent questions about what the dark web is, how leaked data gets there, who can access it, and how criminals can misuse names, phone numbers and loan-related details. This explainer breaks down those risks and what customers should do.

What is the dark web?

The dark web is a deliberately hidden layer of the internet that ordinary search engines such as Google do not index. It runs on encrypted anonymity networks, most commonly Tor (The Onion Router) and I2P, and usually requires special software, configuration, or an invitation to access.

It is important not to confuse it with the deep web. The deep web is simply anything behind a login or database - your email inbox, bank account, medical portal, or an intranet. The dark web is a smaller, intentionally concealed subset of that.

Who can access it

Anyone with a computer or phone can technically download the Tor Browser and visit dark-web sites. Access itself is not illegal in India or most countries. The illegality depends on what a person does there - buying stolen data, drugs, weapons, malware, or hacking services is criminal.

The network is used by a mix of people:

- Journalists, activists, whistleblowers and people in censored countries seeking anonymity.

- Security researchers and law-enforcement agencies monitoring criminal marketplaces.

- Cybercriminals trading stolen credentials, personal records, ransomware tools and access to hacked corporate systems.

Anonymity is not absolute: law enforcement has repeatedly identified and prosecuted operators of dark-web markets, but it does make casual attribution and tracking harder.

Why leaked data ends up there

After a breach, criminals rarely use all the stolen data themselves. They monetise it by publishing samples on leak sites or selling bulk databases to other criminals. Leak sites are specifically used by hackers to showcase stolen information and pressure victims into paying extortion demands.

Common routes include:

- Company or vendor breach: A bank, telecom firm, retailer, call centre, KYC vendor or cloud service is compromised.

- Third-party exposure: Customer data may leak through a partner, outsourced processor, marketing database, loan-lead generator or misconfigured cloud storage.

- Infostealer malware: Malware on an employee’s or customer’s device harvests saved passwords, cookies and session tokens.

- Insider misuse: An employee or contractor copies records.

- Extortion: Ransomware groups publish data to increase pressure when a victim refuses to pay.

In the SBI case, the bank said it received alerts on October 16 from its threat-intelligence provider, the Defence Cyber Agency and CERT-In. Its preliminary review of roughly 3.75 lakh records found 3,897 customer records containing personally identifiable information. SBI has said a detailed investigation is still needed to verify authenticity, source and full extent.

What was allegedly exposed

Reports say the SBI-related dataset included names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses, along with branch and CIF identifiers, lead IDs and metadata associated with loan or lead records.

That combination matters because it is enough to make a scam message or call feel credible. It does not automatically mean bank passwords, PINs, OTPs, full account numbers or money were stolen - but it gives fraudsters the raw material to impersonate a bank convincingly.