Mumbai: State Bank of India (SBI), the country's largest public sector lender, is investigating a suspected data leak involving personal information linked to 3,897 customers. The incident has raised concerns about financial fraud, identity theft and the safety of banking information.
SBI examined approximately 3.75 lakh records found on the dark web and identified 3,897 records containing personally identifiable information.
What Information Was Exposed?
According to SBI's preliminary findings, the exposed records include customer names, mobile numbers, dates of birth, email addresses, residential addresses and loan-related information.
The bank has activated its cybersecurity incident response procedures and appointed an independent CERT-In-empanelled agency to investigate.
SBI maintained that the incident has not materially affected its core operations, financial performance or business continuity.
However, investigators are still examining the authenticity, source and extent of the suspected exposure.
Is Your SBI Bank Account Safe?
Importantly, exposure of personal information does not necessarily mean bank accounts have been hacked.
There is currently no established evidence that passwords, ATM PINs, OTPs or transaction credentials were compromised.
Similarly, identifying 3,897 customer records does not mean an equal number of accounts were accessed or money was stolen.
Nevertheless, customers should remain cautious because exposed personal details could help fraudsters impersonate bank representatives.
How Can Fraudsters Misuse The Data?
Cybercriminals could use leaked information to send convincing messages about KYC verification, loan approvals or account restrictions.
Fraudsters may also make calls pretending to represent SBI, using genuine customer details to gain trust.
Such attempts could trick customers into revealing confidential banking credentials or visiting fraudulent websites.
These remain potential risks rather than confirmed consequences of the incident.
What Should SBI Customers Do?
Customers should never share OTPs, ATM PINs, passwords or other confidential banking information.
Avoid suspicious links, unexpected attachments and calls demanding urgent account verification.
Regularly review account transactions and keep SMS and email alerts enabled.
Customers should access banking services only through SBI's official website, verified applications or authorised customer-care channels.
Those concerned about identity misuse should also monitor their credit reports for unfamiliar loans or enquiries.
Should You Change Your Password?
Changing weak or reused banking passwords is a sensible precaution, although there is no confirmed evidence of widespread credential theft.
Customers noticing suspicious transactions should immediately contact SBI.
Financial fraud can also be reported through India's cybercrime helpline, 1930, or the official portal, cybercrime.gov.in.
For now, SBI's investigation continues, and customers should remain alert without assuming their accounts have been compromised.
