Picture this. Someone finds a bag full of paper slips on the street. Each slip has a name, a phone number and a home address. Then you hear the slips might have come from your bank. Your stomach drops, right?
That’s pretty much the feeling across India this week. The SBI data leak has people asking one big question: “Is my information out there?”
State Bank of India, or SBI, is the biggest bank in the country. On 21 October 2026, it told the stock exchanges that some customer records had turned up on the dark web. A few days earlier, a hacker group had been bragging online that it had a giant pile of SBI data.
So what is true, what is just talk, and what should you do right now? This post explains it all in plain words. No hard tech language. By the end, you’ll know what happened, how to check if you might be affected, and how to keep your money safe.
A quick note: this story is still moving. The bank and outside experts are still looking into it, so some facts may change. I’ll keep this post honest about what is confirmed and what is only a claim.
What Happened in the SBI Data Leak?
Let’s go through it like a timeline, from the first claim to the bank’s reply.
- 16 October 2026: A cybersecurity watcher on X (the app that used to be Twitter) called CyberPulse56 pointed out a strange post. A group calling itself Siriusim had posted on a hacker forum named BreachForums. The group said it had leaked data linked to SBI.
- The claim: About 375,000 rows of data in spreadsheet form (CSV files), plus 2,722 PDF documents. The group said the pile included personal details, loan applications, account opening forms and addresses.
- The free samples: The group put up four sample customer records so people would believe it. One news outlet checked those samples. It reported that the phone numbers were real and working, and that a WhatsApp profile photo matched the passport-style photo in the ID papers of one person.
- 21 October 2026: SBI sent a notice to the stock exchanges. The bank said it had suffered a cyber incident where some data was lost. It had looked through roughly 375,000 records found on the dark web and spotted 3,897 customer records that held personal information.
- What SBI did next: The bank hired an outside cybersecurity company, approved by India’s national cyber agency CERT-In, to dig deeper. SBI also said it did not yet know where the data came from.
Notice something important here. The hackers did not name SBI as a victim first and then SBI agreed with everything. The bank’s own number is much smaller than the hackers’ number. That brings us to the next part.
375,000 vs 3,897: Why Are There Two Numbers?
This is the part that confuses most people, so let me use an example.
Imagine a stranger shouts, “I have a truck packed with 375,000 boxes of your school’s records!” You walk over and open the boxes one by one. Most of them are junk, empty, or copies of stuff that was already public. But 3,897 boxes have real student names and phone numbers inside.
That’s close to what SBI is saying. The big number (375,000) is what the hackers claim is in the pile. The small number (3,897) is how many records the bank has confirmed so far as real customer data with personal details.
Here’s what we still don’t know:
- Whether those 3,897 records belong to 3,897 different people, or whether some people appear more than once.
- What the rest of the 375,000 rows actually contain.
- Whether the data is brand new or just old data from a past leak that got packaged up again. Several reports said this was unclear.
- Whether the data came from SBI itself, a company that works for SBI, or some other partner.
The bank also called its count “preliminary.” That’s a careful word that means “this is our first look, and it may change.” So please don’t treat 3,897 as the final answer.
What Is the Dark Web? (Super Simple Version)
You’ve probably heard the words “dark web” in movies. Let’s clear it up.
Think of the internet like a huge city. The websites you use every day, like YouTube, Google and your school’s page, are the shops on the main street. Anyone can walk in.
The dark web is the hidden back alleys. You can’t get there with a normal browser. You need special software. Plenty of people use these alleys for normal reasons, like staying private in countries where speaking freely is risky.
But criminals love the alleys too. They use them to sell or give away stolen things, and that includes stolen data. A forum like BreachForums is like a noisy market stall where people show off, trade and leak information they’ve grabbed.
When a bank says “found on the dark web,” it simply means the data was spotted in one of those hidden places.
What Kind of Information Could Be Out There?
Based on what the hackers said, the pile may include personal customer details, loan applications and the papers that go with them, account opening forms, and home addresses.
For the 3,897 records the bank checked, some reports say they hold things like phone numbers, dates of birth and home addresses. One digital rights group also pointed out that the bank hasn’t said whether things like Aadhaar, PAN or passport copies are in there. That is an open question right now.
What has not been reported is just as important. So far, no report says that online banking passwords, ATM PINs or card CVV numbers were part of this leak. That’s good news, if it holds up.
Is My Money Safe After the SBI Data Leak?
Short answer: a leak of personal details is not the same as someone breaking into your bank account.
Here’s a way to think about it. Say a stranger learns your home address and your phone number. They know where you live, but they don’t have your house key. They can’t just walk in.
Your bank account works the same way. To move money, a thief usually needs something extra, like your OTP (the one-time code that comes by SMS), your PIN or your password. A list of names and addresses doesn’t hand them those.
SBI has also said, according to reports, that this incident has not seriously hurt its day-to-day work or business. And so far, I haven’t seen any report of customers’ accounts being emptied because of this.
But don’t relax completely. Here’s the real danger.
The risk is tricks, not break-ins. When a scammer knows your name, your phone number and maybe even your loan details, they can phone you and sound like the real bank. That’s called phishing (say it like “fishing”). The scammer is fishing for your OTP or password, and your leaked details are the bait that makes the call sound true.
How to Check If Your Details Were Exposed
I’ll be honest with you, because it matters. At the time of writing, SBI had not put out a public tool where you can type your number and see if you’re in the leak. Some digital rights groups have asked for one. So there’s no magic “check now” button yet.
But you can still do a lot. Try these steps:
- Watch for an official message from SBI. The bank may contact affected customers by SMS, email or letter. If you get something, don’t tap the link inside it. Open the official SBI website or the YONO app yourself and look for the same notice there.
- Call the official helpline. Use the number on your passbook, your debit card or the real SBI website. Don’t trust a number you found in an ad or a random search result, because scammers often pay to show up there.
- Visit your home branch if you’re worried. Ask them directly whether your account is linked to the incident. Staff can also help you lock down your account.
- Check your email on Have I Been Pwned. It’s a free website that tells you if your email address shows up in known breaches. It may not include this one yet, and that’s okay. It’s still a handy check for older leaks.
- Look through your bank statement. Scan the last few months of transactions. Any payment you don’t remember should be reported right away.
- Look at your credit report. Leaked personal details can be used to apply for loans in your name. In India you can get a free credit report from each credit bureau once a year. Check for loans or credit cards you never asked for.
- Check the SIM cards under your name. The government’s Sanchar Saathi portal lets you see how many mobile numbers are registered with your ID. If you spot one you don’t know, you can report it there.
One more thing. If nobody has contacted you, that doesn’t prove you’re safe. The investigation isn’t done. So it’s smart to follow the protection steps below even if you never get a message.
10 Easy Steps to Protect Yourself Right Now
You don’t need to be a computer expert for these. Each one takes a minute or two.
- Never share your OTP, PIN, CVV or password. Ever. A real bank worker will never ask for them. Not on a call, not on WhatsApp, not by SMS.
- Don’t click links in messages. If a text says “update your KYC now,” type the bank’s address yourself or use the official app instead.
- Hang up on surprise “bank officer” calls. Then call the bank back using the official number. A real bank won’t mind.
- Turn on alerts. Make sure SMS and email alerts are switched on for every transaction, even small ones.
- Change your net banking and YONO passwords. Pick a long one you don’t use anywhere else. A password manager can remember it for you.
- Turn on two-step login for your email and WhatsApp. Your email is the key to resetting many other accounts, so guard it well.
- Set a limit on UPI and card payments. A lower daily limit means a thief can’t take much, even if they get lucky.
- Block cards you don’t use. An unused card is just another door for a thief to try.
- Check your account often for the next two months. Think of it like checking your bike lock every day when you know thieves are around.
- Report trouble fast. If money goes missing, call your bank first, then call the national cybercrime helpline 1930 and file a report on the cybercrime.gov.in portal. Speed matters. The sooner you report, the better the chance of freezing the money.
Scams to Watch Out For After a Leak
After any big leak, scammers get busy. They know people are worried, and worried people make mistakes. Here are some tricks that often show up:
- The “we found a leak, let’s protect you” call. It’s a bit funny, but a scammer may say they’re calling about the very leak you’ve read about. Then they ask for your OTP “to secure your account.” Don’t fall for it.
- The KYC deadline text. “Your account will be blocked today unless you update your KYC.” Fear and a ticking clock are classic scammer tools.
- The fake loan offer. If your loan details leaked, someone might offer to “reduce your interest” or “approve a new loan” if you pay a small fee first.
- The fake customer care number. A scammer buys an ad or posts a fake number online. You search for help, find the wrong number, and hand your details to a crook.
- The refund trick. They say money was sent to you by mistake and ask you to send it back, or to approve a “collect request” on UPI.
Here’s the golden rule. Knowing your real details doesn’t make someone a real bank worker. After a leak, a scammer might know your name, your number and even your branch. That proves nothing. Only you decide who you trust, and you do it by calling back on a number you checked yourself.
What Are People Saying About SBI’s Response?
Not everyone is happy with how this has been handled so far, and it’s fair to tell you what critics said.
The Internet Freedom Foundation, a digital rights group in India, said the leak was already public before the bank said anything. It also said SBI told the stock exchanges but, as of its statement, had not told the customers whose data was involved. The group asked the bank to message every affected person by SMS, email and letter, to set up a helpline, and to build an online way for people to check. The opposition party Congress also raised questions about why customers hadn’t been told.
On the other side, the bank has said it hired an outside, government-approved expert team to investigate and that it’s still verifying the data. Investigations like this take time, and a bank can’t announce details it hasn’t confirmed. Both points are fair, and we’ll know more as the investigation moves along.
Is This the First Time Something Like This Has Happened?
Sadly, no. Banks around the world get hit by leaks, and India has seen its share.
- In 2019, a researcher found an SBI text-message service server that had no password. It could have shown account balances and recent transactions. SBI said the problem was a mistake in a process run through telecom partners, that it was fixed, and that its own servers stayed secure.
- In July 2026, Bank of Baroda admitted to a leak. Reports said a hacker had posted about one terabyte of data online for free.
Notice a pattern? Often the weak spot isn’t the bank’s main vault. It’s a side door, like a partner company, an old system or a setting someone forgot to lock. That’s why the question “where did this data come from?” matters so much in the SBI case.
What Can We Learn From This?
Here are the big lessons, in kid-friendly form.
1. Assume your basic details are already floating around. Your name, number and address have probably shown up in a leak somewhere over the years. So build good habits instead of hoping nothing ever leaks.
2. Slow down when you feel rushed. Scammers want you to act fast. If a message makes you panic, that’s your signal to pause. Take a breath, then check the facts.
3. Use different passwords. If one password leaks and you use it everywhere, a thief can open lots of doors with one key.
4. Share less. Every place that stores your details is one more place that can leak. Don’t hand over copies of your ID unless it’s really needed.
5. Talk to your family. Parents and grandparents are often the main targets of phone scams. Spend ten minutes today explaining the “never share your OTP” rule to them. It could save someone a lot of money.
Frequently Asked Questions About the SBI Data Leak
Was SBI hacked?
It isn’t confirmed. SBI says it had a cyber incident involving the loss of some data, but it has said it doesn’t yet know where the data came from. An outside expert team is looking into it.
How many SBI customers are affected?
The bank’s early check found 3,897 customer records with personal information inside a pile of about 375,000 records. That number is preliminary and may change. It also isn’t clear yet if each record is a different person.
Can hackers take money from my account using this data?
Names and addresses alone don’t let someone move your money. A thief would still need things like your OTP, PIN or password. The real risk is scammers using your details to trick you into giving those up.
Who is Siriusim?
Siriusim is the name used by the group that made the claim on BreachForums. Very little is known about it, and SBI hasn’t publicly linked the group to the leaked records.
Should I change my SBI password?
Yes. There’s no sign that passwords were leaked, but changing yours is a cheap, quick way to be safer. Choose a strong, unique one, and turn on alerts too.
Where do I report fraud?
Call your bank right away, then dial 1930, India’s national cybercrime helpline, and file a complaint at cybercrime.gov.in. The faster you act, the better your chances.
Will SBI tell me if my data was leaked?
That hasn’t been made clear yet. Critics have asked the bank to notify every affected customer directly. Until you hear something official, stay alert and follow the safety steps in this post.
Final Thoughts
The SBI data leak is a good reminder that our information lives in lots of places, and we can’t control all of them. But we can control how we react.
Don’t panic. The bank’s confirmed number is far smaller than the hackers’ claim, and nobody has shown that accounts have been emptied. At the same time, don’t ignore it. Change your passwords, switch on alerts, check your statements, and treat every “urgent” call or message with a big dose of doubt.
Stay calm, stay curious and stay careful. I’ll update this post when new, confirmed details come out.
This post is for general information. It isn’t legal or financial advice. For anything about your own account, talk to your bank directly.
