SBI Investigates Reported Dark Web Data Exposure and Security Risks

The financial sector is preparing for the full implementation of the Digital Personal Data Protection (DPDP) Act 2023. This law takes effect on May 13, 2027. Cyber law expert Pavan Duggal stated that banks could face fines of 2.5 billion rupees (250 crore) per contravention under the new rules. Meanwhile, investigators are examining a data breach at the State Bank of India (SBI).

1. State Bank of India (SBI) stated the incident will not materially affect its IT systems, core business operations, or financial performance. The bank expects to maintain operational stability despite the breach.

2. The bank confirmed that customer financial assets and balances remain secure.

3. SBI activated its cyber incident response and containment protocols promptly. The bank also engaged an independent CERT-In-empanelled cybersecurity agency to investigate the authenticity and extent of the data exposure.

4. The bank acted on alerts received on October 16, 2026, from the Defence Cyber Agency, CERT-In, and its own threat intelligence provider.

1. Cybersecurity expert Dhiraj Gupta warned that fraudsters may use the leaked information to create more convincing social engineering scams. He stated that the exposure of personal details leaves customers vulnerable to subsequent fraud.

2. Analysts identified 3,897 records containing personally identifiable information within a 375,000-record set found on the dark web. The compromised files include names, mobile numbers, birth dates, and gender. They also list email addresses, residential addresses, branch details, customer identification numbers, and loan metadata.

3. Cyber law expert Pavan Duggal noted that if the DPDP Act 2023 were fully in force, the bank could face fines of ₹250 crore per contravention. This highlights the significant financial and regulatory risks banks face regarding data protection as legal standards evolve.

4. This event is the second cybersecurity breach at a public sector bank since July 2026. Bank of Baroda reported a security incident during that month.