SBI Data Breach: Are You Exposed? 5 Urgent Steps Now

The SBI data breach is now confirmed by the bank itself. In a stock exchange filing reported on 21 October, State Bank of India said it found 3,897 customer records with personal details among roughly 3.75 lakh records sitting on the dark web.

That number sounds small for a bank with over 50 crore customers. However, the leaked fields are exactly what scammers need to sound like a real bank officer. So even if your record is not in the set, the fake calls that follow could still reach you.

This piece answers three questions. What actually leaked? Could you be affected? And what should you do today to keep your money safe?

The Short Version

• What SBI confirmed: 3,897 customer records with personal information, found during a first check of about 3.75 lakh dark web records.
• What leaked: Names, registered mobile numbers, dates of birth, gender, email, home address, branch and CIF details, plus loan and lead metadata.
• What is only a claim: A group calling itself Siriusim says it holds 3.75 lakh entries and 2,722 PDF files. This is not independently verified.
• What SBI says about money: No material impact on core operations, and services are running normally.
• What you should do: Treat any call or SMS quoting your loan or account details as suspicious, and follow the five steps below.

What Happened in the SBI Data Breach?

According to the filing, SBI received alerts on 16 October from three places: its threat intelligence provider, the Defence Cyber Agency and CERT-In. All three flagged suspected exposure of SBI customer data on the dark web.

The bank then switched on its cyber incident response and containment process. It has also hired an independent cybersecurity firm empanelled by CERT-In to run a full assessment, as The Tribune reported.

Meanwhile, the hacker claim came first on social media. A cybersecurity monitoring account on X, CyberPulse56, flagged that a group named Siriusim was offering SBI-linked data. According to Outlook Money, the claim surfaced on 16 October. The group reportedly called it an initial release of a bigger collection, which suggests more files may appear.

So far, SBI has not named who is responsible. It also has not linked the incident to Siriusim.

SBI Data Breach: Confirmed Facts vs Hacker Claims

Not everything you read on social media is confirmed. Here is the clear split, based on the bank’s filing and news reports from 20 and 21 October.

The key takeaway is simple. The confirmed leak is about identity and contact details, not passwords or card PINs. That is still serious, because it powers targeted fraud. Next, let us see who is most at risk.

Could You Be Affected by the SBI Data Breach?

SBI has not published a list or a lookup tool for affected customers. So there is no reliable way to check your name today. Be careful of any website or WhatsApp message that offers to “check if your SBI data leaked”. That is a classic trap.

However, the leaked fields give a hint. The records include lead IDs and metadata tied to loan and lead records, according to Digit. That means people who applied for, or enquired about, an SBI loan may face higher risk.

For example, a fraudster who knows your name, date of birth, branch and loan enquiry can call and say, “Sir, your home loan file is pending, please confirm the OTP.” It sounds real because the details are real. Because of this, the smartest move is to act as if your data is out there.

How to Protect Yourself After the SBI Data Breach: 5 Steps

These steps take about 15 minutes. None of them costs money.

1. Never share an OTP, PIN or password. No genuine bank employee needs them. Hang up on anyone who quotes your loan, branch or date of birth and then asks for a code.
2. Ignore fee requests for loans. Do not pay any “processing fee” to an unknown caller or link to unlock a loan. Fraudsters often use loan lead data for this exact scam.
3. Check your statements and turn on alerts. Review recent transactions in the YONO app or net banking. Make sure SMS and email alerts are on, so you see every debit at once.
4. Check your credit report for unknown loans. Look for loans or credit cards you never applied for. Leaked date of birth and address details can help someone attempt a fake loan.
5. Lock your Aadhaar biometrics as a precaution. Aadhaar is not in SBI’s confirmed list. Still, you can lock biometrics on the official myAadhaar portal or the mAadhaar app using an OTP on your registered mobile. You can unlock it the same way when needed.

Also, do not open attachments or install apps sent over SMS or WhatsApp. Our guide on how to spot a fake WhatsApp app shows how these lookalike apps steal banking details.

Where to Report SBI Data Breach Scams

If you get a suspicious call or message, report it quickly. Speed matters, because fast reports help freeze stolen money.

• Email SBI: SBI’s official cyber security page asks customers to send phishing reports to [email protected].
• Call 1930: This is the national cyber crime helpline listed on the same SBI page.
• File online: You can lodge a full complaint at cybercrime.gov.in.

If money has already left your account, block your card in the YONO app first. Then call 1930 and file a complaint right away.

Is Your Money Safe With SBI Right Now?

Based on what is public today, yes, your deposits are not at direct risk from this leak. SBI says the incident has no material impact on its core business operations, financial performance or business continuity. Investors seem calm too. SBI shares traded flat at about Rs 970 on the BSE around 10 am IST on Wednesday, as IBTimes India noted.

However, safe deposits do not mean you are safe from scams. The real danger is social engineering. A scammer with your real details can trick you into moving money yourself, and banks often treat that as an authorised payment.

This also fits a wider trend. CERT-In has already been warning about new digital risks, as we covered in our report on the CERT-In warning on AI agents.

What to Watch Next in the SBI Data Breach Story

This story is still developing. Here is what will matter in the coming days:

• The final count: SBI’s 3,897 figure comes from a preliminary review. The number could rise or fall after the full audit.
• The source: It is still unknown whether the data came from SBI systems or from a third-party vendor.
• More dumps: The hacker group hinted that more files may follow.
• Customer alerts: Watch for any official SMS or email from SBI to affected customers. Verify it only through the SBI app or website.

We will update this post as SBI shares more details.

Our Verdict: What You Should Do Today

Do not panic, and do not close your account. There is no sign that balances have been touched. However, do treat every unexpected “SBI” call this month as a scam until proven otherwise.

So, spend 15 minutes today. Turn on alerts, check your credit report and lock your Aadhaar biometrics. Most importantly, share this with older family members, because they are the most common targets of fake bank calls. While you are at it, review your other accounts too, such as the steps in our guide to Google phone number verification.

Conclusion

The SBI data breach is smaller than the hacker claims, but the leaked details are exactly what fraudsters need. Your best defence is simple: never share codes, verify every caller and report scams fast.

Have you received a suspicious call claiming to be from SBI this week? Tell us in the comments what the caller said, so other readers can spot the same trick.