A large dataset connected with State Bank of India appeared on the dark web. SBI has confirmed that customer information is involved — but the headline numbers need care. Around 3.75 lakh records were examined, while SBI’s preliminary review identified 3,897 customer records containing personally identifiable information. What happened, what remains unknown, and what does Indian law require when a bank loses control of customer data?
Update log
22 October 2026: Legal analysis updated to reflect the RBI’s 2026 cybersecurity framework, the current DPDP commencement timetable, RB-IOS 2026, the transition away from Section 43A of the IT Act, and the revised customer-liability framework scheduled for 1 January 2027.
21 October 2026: SBI publicly disclosed the data-loss incident to the stock exchanges.
- SBI says it was alerted on 16 October 2026 by its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In.
- SBI has engaged an independent CERT-In-empanelled cybersecurity agency to investigate.
- The bank says the incident has caused no material impact on its core business operations, financial performance or business continuity.
- The source of the exposed data, the contents of the wider dataset and the complete number of individuals affected remain under investigation.
There is no basis at present to assume that every SBI account has been compromised. But be particularly careful if a caller or message already knows your date of birth, address, SBI branch, CIF-related information or loan details. That knowledge does not prove that the person contacting you is from the bank.
Never disclose an OTP, PIN, CVV, user ID or banking password.
The SBI Data-Loss Incident: What Is Actually Confirmed?
The story does not begin with SBI announcing that hackers had broken into its core banking system. It begins with something more uncertain: customer-related data associated with the bank was found on the dark web.
SBI says that on 16 October 2026 it received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In concerning suspected exposure of customer data. The bank activated its cyber-incident response and containment mechanisms, began examining the material and subsequently appointed an independent CERT-In-empanelled cybersecurity agency. On 21 October 2026, SBI disclosed the matter to the BSE and NSE under Regulation 30 of the SEBI Listing Regulations.
Magnitude: 3.75 lakh records do not necessarily mean 3.75 lakh customers
The approximate quantity of records examined from material reportedly available on the dark web.
Records SBI identified as containing personally identifiable information relating to its customers.
A database row is not necessarily a unique customer. Large datasets can contain duplicate entries, incomplete records, repeated leads, technical metadata and information whose authenticity has not yet been established. It would therefore be premature to report that the personal data of 3.75 lakh SBI customers has been confirmed as leaked.
A threat actor calling itself “Siriusim” has also reportedly claimed possession or publication of a larger collection, including thousands of PDF files. A cybersecurity-monitoring account, CyberPulse56, reportedly drew public attention to the claim on 16 October. These remain reported threat-actor claims: the authenticity, contents, duplication and number of unique individuals represented by the material have not yet been independently established.
What Data Was Exposed — and Why It Can Still Be Dangerous
SBI’s preliminary assessment reportedly identified categories of customer information including:
SBI’s public disclosure does not presently identify PINs, OTPs or internet-banking passwords among the categories found. That is reassuring, but it should not be stretched into a conclusion about every document or data field contained in the larger collection still under examination.
Fraud does not always begin with a stolen password
Consider a caller who already knows your full name, mobile number, date of birth, residential address, home branch and the loan for which you recently applied. That caller may sound far more convincing than a random scammer. The information can be used to prepare targeted phishing or vishing attempts, impersonate bank personnel, manufacture urgency and persuade a victim to disclose the authentication credential that the attacker does not yet possess.
That is why the seriousness of a banking-data incident cannot be measured only by asking whether balances changed or banking services stopped working.
SBI’s “no material impact” statement needs context
SBI has told the securities market that the incident has no material impact on its core operations, financial performance or business continuity. That is a legitimate question for a listed company to answer, but it is not the same question as whether an individual customer may face privacy or fraud risk. A bank can continue functioning normally while particular customers face increased exposure to impersonation and social-engineering attacks.
RBI and CERT-In: The Rules That Apply Before the DPDP Act Fully Commences
Banks hold identity information, financial relationships, KYC records and behavioural information that can be unusually valuable to a fraudster. RBI therefore treats cybersecurity and customer-data protection as regulatory obligations rather than matters left entirely to a bank’s commercial discretion.
RBI’s 2026 Cybersecurity Directions
On 31 July 2026, RBI issued the Reserve Bank of India (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026. They apply expressly to the State Bank of India and came into effect immediately.
The framework requires commercial banks to maintain controls against loss or leakage of sensitive and confidential business and customer information, including safeguards over information at endpoints, during transmission, in storage and within relevant third-party or vendor environments.
It also requires cyber incidents to be reported to RBI through DAKSH within six hours of detection, together with appropriate escalation and communication arrangements.
The existence of these duties does not establish that SBI breached them. The public stock-exchange filing does not reveal the complete internal detection timeline, SBI’s regulatory correspondence, the controls that were in place or the findings of the independent investigation.
RBI Advisory No. 3/2026: useful, but not the same as a binding Direction
RBI’s Department of Supervision also issued Advisory No. 3/2026 on Best Practices relating to Customer Data Protection on 25 March 2026. Based on a thematic study of supervised entities, it records practices concerning governance, data classification, vendor risk, incident response, post-incident analysis and multi-channel customer communication.
Its legal status should be stated carefully. The document is illustrative supervisory guidance; it does not override existing law and should not be treated as identical to RBI’s binding Cybersecurity Directions. Nevertheless, it is relevant when assessing what RBI considers mature customer-data protection practice.
CERT-In’s six-hour reporting rule
CERT-In’s Directions of 28 April 2022, issued under Section 70B(6) of the Information Technology Act, require covered organisations to report specified cyber incidents within six hours of noticing the incident or of it being brought to their notice. The list of reportable incidents expressly includes both a “Data Breach” and a “Data Leak.”
Importantly, reporting to CERT-In and RBI is not the same thing as informing an affected customer. That gap is one reason why the delayed commencement of the DPDP breach-notification regime matters so much.
SBI’s Potential Legal Liability: A Breach Is Not the Same as Proven Negligence
The discovery of customer information on the dark web is serious, but legal liability does not follow automatically from the existence of a leak. A court or regulator would ordinarily need to ask how the information escaped, what security measures were in place, whether a third-party vendor was involved, whether applicable regulatory duties were followed, and whether the alleged failure caused legally recognisable loss.
Section 43A of the IT Act still matters — for now
As of 22 October 2026, Section 43A of the Information Technology Act, 2000 remains in force. It provides a compensation route where a body corporate handling prescribed sensitive personal data or information is negligent in implementing and maintaining reasonable security practices and thereby causes wrongful loss or wrongful gain.
Section 44(2) of the Digital Personal Data Protection Act, 2023 provides for omission of Section 43A of the IT Act. But Section 44(2), like the principal substantive obligations in Section 8 of the DPDP Act, is in the eighteen-month commencement tranche notified on 13 November 2025.
On the present timetable, both changes take effect on 13 May 2027. Until then, Section 43A remains part of the existing liability framework.
Why PII and SPDI are different under the present law
Section 43A does not apply merely because information can identify a person. It is built around the narrower category of sensitive personal data or information (SPDI) under the 2011 Rules, which includes categories such as passwords, financial information, health information and biometrics. Whether particular material in this incident falls within SPDI therefore depends on what the files actually contain.
The DPDP Act takes a materially different approach. Its definition of personal data covers data about an identifiable individual and the Act does not depend on the old SPDI classification before its general data-protection duties apply. In that sense, the present PII-versus-SPDI threshold problem under Section 43A largely disappears once the substantive DPDP regime becomes operative.
SBI also has a duty of confidentiality
Cybersecurity legislation is not the beginning of a bank’s duty to protect customer information. Section 44 of the State Bank of India Act, 1955 requires SBI to observe fidelity and secrecy in relation to the affairs of its constituents, subject to recognised exceptions.
Indian courts have also applied the traditional Tournier principle of banker-customer confidentiality. In Shankarlal Agarwalla v. State Bank of India, AIR 1987 Cal 29, the Calcutta High Court recognised the banker’s obligation of secrecy and the traditional exceptions — disclosure compelled by law, disclosure in the public interest, protection of the bank’s own interest, and disclosure made with the customer’s express or implied consent.
If stolen data is used for fraud
Separate rules apply if an attacker subsequently uses the information to steal money or impersonate a customer. Unauthorised access, copying or extraction from a computer resource may attract Section 43 of the IT Act; where Section 43 conduct is carried out dishonestly or fraudulently, Section 66 provides criminal consequences.
If stolen identifiers are actually used, additional provisions may become relevant: Section 66C deals with fraudulent or dishonest use of another person’s password, electronic signature or other unique identification feature, while Section 66D deals with cheating by personation using a computer resource or communication device. Depending on the conduct, Sections 318 and 319 of the Bharatiya Nyaya Sanhita, 2023, concerning cheating and cheating by personation, may also apply.
Those latter provisions should not be mechanically attached to the existence of leaked data. They become relevant when the facts disclose the additional elements of identity misuse, deception or personation.
What if an unauthorised banking transaction follows?
For an unauthorised electronic banking transaction occurring today, the familiar RBI customer-protection framework remains important. It provides zero customer liability where the unauthorised transaction results from contributory fraud, negligence or deficiency on the part of the bank, irrespective of whether the customer reports it.
In a qualifying third-party breach where the deficiency lies neither with the bank nor with the customer, the current framework provides zero liability where the customer notifies the bank within three working days of receiving communication about the unauthorised transaction. The burden of proving customer liability lies on the bank.
Informational Privacy and the Right to Know About a Breach
Why should the law care about the disclosure of a name, mobile number, residential address or date of birth if no money has yet disappeared from the customer’s account? Because Indian privacy law protects more than financial balances. It protects the individual and his or her control over personal information.
Puttaswamy and informational privacy
In Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, a nine-judge Bench of the Supreme Court unanimously recognised privacy as a fundamental right. Particularly important for modern databases is the judgment’s recognition of informational privacy and of the positive dimension of privacy protection.
Puttaswamy, however, should not be made to do work that the judgment itself did not do. It does not prescribe a six-hour customer notice, a particular SMS format or a statutory damages schedule for every data leak. It supplies the constitutional foundation; specific obligations must still be found in legislation and sectoral regulation.
SBI’s Article 12 status adds a constitutional dimension
SBI is not simply another private commercial entity. Courts have treated it as “State” or an “other authority” within Article 12. The Bombay High Court, for example, reached that conclusion in State Bank of India v. Kalpaka Transport Co. Pvt. Ltd..
That means constitutional standards can, in an appropriate case, be invoked against SBI through writ jurisdiction. A customer could therefore seek public-law relief in a suitable case involving an alleged violation of fundamental rights. But maintainability, the precise relief available, disputed facts and the existence of alternative statutory remedies would still matter. Article 21 does not create automatic compensation every time customer data is exposed.
The DPDP Act enacts a notification duty — but it is not yet in force
Section 8(6) of the Digital Personal Data Protection Act, 2023 enacts a clear rule: when a personal-data breach occurs, the Data Fiduciary must intimate the Data Protection Board and each affected Data Principal in the prescribed manner. Rule 7 of the 2025 Rules develops the notification mechanism.
The important point is commencement. The Gazette notification dated 13 November 2025 places Sections 7 to 10, including Section 8, in the group commencing eighteen months after publication. On the presently notified timetable, that means 13 May 2027.
Consequently, it would be incorrect to state that SBI is presently in breach of Section 8(6) merely because its stock-exchange filing does not say whether affected customers were individually informed.
Equally, the absence of an operative Section 8(6) does not mean that customer notification is pointless. RBI’s supervisory guidance already treats customer communication as an important incident-response practice, and notification allows an individual to recognise precisely the kind of targeted social-engineering fraud that exposed banking-related information can enable.
A customer who knows that personal information has escaped can change behaviour, scrutinise convincing-looking calls and messages, and react faster to attempted fraud.
What Can an Affected SBI Customer Actually Do?
The answer depends on whether the complaint concerns mere exposure, deficient banking service, demonstrable financial loss or an actual cybercrime. Indian law presently offers several overlapping routes rather than a single universal “data breach compensation” claim.
Complain to SBI first
Ask the bank whether your information is part of the affected material, what categories of information are involved, and what protective measures are recommended. If an unauthorised transaction has occurred, report it immediately rather than waiting for the forensic investigation.
IT Act compensation
Where the conditions of Section 43A are satisfied — including SPDI, negligence in reasonable security practices and resulting wrongful loss or gain — compensation may be pursued through the IT Act adjudicatory framework. Under Section 46, the Adjudicating Officer has jurisdiction over claims for damage up to the statutory threshold of ₹5 crore; claims above that threshold lie before the competent court.
RBI Ombudsman
If the grievance concerns a deficiency in banking service and SBI does not resolve it satisfactorily, the customer may, subject to the Scheme’s maintainability requirements, approach the RBI under the Reserve Bank–Integrated Ombudsman Scheme, 2026. The current Scheme came into force on 1 July 2026 and replaced RB-IOS 2021.
Consumer Commission
A banking customer may have a remedy under consumer law where a deficiency in service can be established. But the Supreme Court has cautioned that highly disputed questions involving fraud, criminality or complex evidence may not be suitable for summary consumer adjudication. A leak should therefore not automatically be converted into a consumer compensation award.
Cybercrime reporting
Where exposed information is used for phishing, impersonation or financial fraud, report the incident promptly through the National Cybercrime Reporting Portal and the national financial cyber-fraud helpline 1930, in addition to informing the bank.
Constitutional remedy in an appropriate case
Because SBI has Article 12 status, writ jurisdiction under Article 226 may be available where the facts genuinely raise a public-law or fundamental-rights issue. This is not necessarily the first or simplest route for an ordinary transactional complaint, but it is legally relevant in a serious informational-privacy case.
Do not wait for the SBI data-leak investigation to finish. Notify SBI immediately, preserve the SMS/email/WhatsApp/call evidence, report the transaction through the cyber-fraud mechanism and act within the shortest possible period. The current RBI framework makes the timing of a customer’s report important in third-party breach cases.
What Earlier Indian Data Incidents Tell Us
India has seen several major cyber incidents, but they do not all produce the same legal response. That is itself an important lesson for the SBI case.
Government records stated that five physical servers at AIIMS, New Delhi were affected and that CERT-In evaluated the incident and advised remedial measures. The lesson was primarily one of incident containment, network architecture and operational resilience.
A very large dataset attributed to ICMR was reportedly offered on the dark web. The episode led to a Delhi Police investigation and arrests. It illustrates the criminal-investigation side of a suspected data sale, but the headline scale and provenance should not be treated as a judicially established benchmark for other breaches.
Following the well-publicised Star Health cyber episode, IRDAI subsequently imposed a ₹3.39 crore penalty and warning for violations it established under its Information and Cyber Security Guidelines, 2023. The important lesson is not that every breach produces a penalty; it is that a regulator may separately examine whether required security controls were actually followed.
The IFF Critique: Fair Questions, but Careful Conclusions
The Internet Freedom Foundation has asked important questions: whether identified customers have been notified, whether SBI should establish a dedicated checking facility, what the wider dataset contains, whether KYC documents are involved and how the information left the controlled environment. Those are legitimate accountability questions.
At the same time, advocacy language should not be mistaken for a judicial or regulatory finding. IFF’s headline characterisation that SBI told investors the breach “doesn’t matter” is rhetoric. SBI’s actual filing says there is no material impact on its core operations, financial performance or business continuity. That is not the same proposition.
| Question | Objective position |
|---|---|
| Has SBI said customer privacy is unimportant? | No. It said the incident has no material impact on specified aspects of its business. The privacy consequences for individual customers are a separate issue. |
| Does SBI’s filing prove that affected customers were not informed? | No. The filing does not say whether they were individually informed. Public silence on that point is not proof that no private notification occurred. |
| Is customer notification nevertheless a reasonable demand? | Yes. It is consistent with fraud-risk mitigation, RBI’s customer-data protection guidance and the direction in which the DPDP regime is moving. |
| Has SBI’s legal liability already been established? | No. The forensic source, security controls, regulatory compliance, causation and actual customer harm remain matters requiring evidence. |
What should happen next?
Identify the source. The forensic review should establish whether the data originated inside SBI, through a vendor or agent, through a lead-management process or elsewhere.
Establish the actual number of individuals affected. Dataset size and unique customers are different measurements.
Verify the reported documents. Investigators should determine whether the wider material contains Aadhaar, PAN, passport, KYC, financial statements, account-opening forms or other especially sensitive documentation.
Communicate useful information to identified customers. Once an individual’s exposure is reliably established, notice can materially reduce the risk of targeted social engineering.
Create a safe checking mechanism. Customers should not have to rely on rumours or dubious “breach-check” websites to discover whether they are affected.
Publish meaningful findings when the investigation permits. Transparency about cause, scale and remediation can coexist with the need not to disclose technical information that would help attackers.
Those questions should ultimately be answered by the forensic record, regulatory findings and evidence — not by either alarmism or reassurance unsupported by the investigation.
Frequently Asked Questions
Is my SBI bank account unsafe?
There is no evidence that every SBI account has been compromised. SBI says its core operations continue normally and the source and full extent of the data exposure are still being investigated. Customers should nevertheless be alert to convincing phishing or impersonation attempts using genuine personal information.
Were SBI passwords, PINs or OTPs leaked?
SBI’s publicly identified categories of information do not presently list PINs, OTPs or internet-banking passwords. That does not establish the contents of every record or document in the wider material under investigation.
Is SBI presently liable under the DPDP Act for not notifying customers?
The DPDP Act enacts an individual breach-notification duty under Section 8(6), but that provision is not yet operative. On the current notified timetable it commences on 13 May 2027. Liability under other laws and RBI requirements must be analysed separately.
Can an affected customer claim compensation?
Potentially, but not automatically. Depending on the facts, routes may include Section 43A of the IT Act while it remains in force, banking grievance mechanisms, RB-IOS 2026, consumer law and ordinary civil or constitutional remedies. Each route has different legal requirements.
What should I do if I receive a suspicious SBI call?
End the call and independently contact SBI through an official channel. Never disclose an OTP, PIN, CVV or password merely because the caller already knows other personal information about you.
What should I do if an unauthorised transaction occurs?
Report it to SBI immediately and report cyber-enabled financial fraud through the National Cybercrime Reporting Portal or helpline 1930. Preserve all messages, transaction references, telephone numbers and other evidence. Delay can affect customer liability under the RBI framework.
Primary Legal and Regulatory Sources
- State Bank of India — Regulation 30 disclosure, “Incident involving Data Loss”, 21 October 2026
- RBI — Commercial Banks: Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026
- RBI Department of Supervision — Advisory No. 3/2026, Best Practices relating to Customer Data Protection
- CERT-In Directions under Section 70B(6) of the IT Act, 28 April 2022
- Gazette Notification G.S.R. 843(E), 13 November 2025 — phased commencement of the DPDP Act
- Digital Personal Data Protection Act, 2023
- State Bank of India Act, 1955 — Section 44
- RBI — Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions
- RBI — Commercial Banks Responsible Business Conduct Third Amendment Directions, 2026
- Reserve Bank–Integrated Ombudsman Scheme, 2026
- Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1
- Internet Freedom Foundation analysis of the SBI incident, 21 October 2026
Reports concerning the threat actor “Siriusim”, CyberPulse56 and the claimed PDF archive have been treated as reported allegations rather than verified findings.
LexBatch | Learn. Litigate. Succeed.
This article is intended for legal information and public awareness and
does not constitute legal advice. It reflects publicly available information
and the legal position as understood on 22 October 2026.
The forensic investigation is continuing, and the factual or regulatory
position may change if SBI, RBI, CERT-In, a court or another competent
authority releases further information.