SBI Data Breach: What Happened and What Indian Businesses Should Learn

On 21 October 2026, State Bank of India told the stock exchanges that customer records had surfaced on the dark web. The SBI data breach is still being investigated, and plenty of answers are missing. The questions it raises, though, are not really about banking. Any company that holds customer names, phone numbers and loan details is one leaked file away from the same headline.

What happened in the SBI data breach

The sequence matters, because the gap between the first alert and the first customer message is where the debate sits.

• 16 October 2026: SBI received alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In about suspected customer data on the dark web. The same day, a threat actor calling itself “Siriusim” was reported to have claimed a release of 3.75 lakh rows of data and 2,722 PDF documents linked to SBI.
• 21 October 2026: SBI filed a disclosure titled “Incident involving Data Loss” with BSE and NSE under Regulation 30 of the SEBI listing regulations. The bank said a preliminary review of roughly 3.75 lakh records found 3,897 containing personally identifiable information. It has activated incident response protocols and engaged an independent CERT-In empanelled agency. It also said the incident has no material impact on core business, financial performance or continuity.

What data was exposed, and why it matters

The identified records reportedly include names, registered mobile numbers, dates of birth, gender, email and residential addresses, branch and customer identification numbers, and metadata tied to loan and lead records. No single field is dramatic. Together they are exactly what a fraud caller needs.

Picture a call from someone who knows your name, date of birth, branch and the loan you applied for. They sound like the bank. The usual advice, never share your OTP, assumes people can tell a fraudster from an official, and leaked data weakens that. This is why who gets told matters as much as what leaked.

What is still unknown

SBI has not yet established whether the data is authentic and complete, where it came from, or how far the exposure goes. Several questions are open:

• What do the remaining records, beyond the 3,897 identified, contain?
• Are the 2,722 documents claimed by the threat actor genuine, and do they carry identity copies?
• How did the data leave the bank’s environment, and did a partner or vendor handle it?
• Have the affected customers been told directly? As of the Internet Freedom Foundation’s 21 October analysis, it could find no customer notice.

Which rules apply today

A common assumption is that India has no breach law until the DPDP Act bites. Not quite. Several duties already run to regulators and investors.

A company can satisfy every row in force today and still leave customers uninformed. That gap closes in May 2027.

What the DPDP Act will require from May 2027

Section 8(6) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to inform the Data Protection Board and every affected Data Principal about a personal data breach. Rule 7 of the DPDP Rules, 2025 supplies the mechanics: an initial intimation to the Board without delay, then detailed particulars within 72 hours, unless the Board allows longer on written request. Affected individuals must also be told without delay, in clear and plain language.

Commentary on the Rules widely notes there is no severity threshold. A small leak is still reportable. Rule 6 adds reasonable security safeguards, and the Act’s Schedule sets penalties of up to ₹250 crore for failing to take them and up to ₹200 crore for failing to notify a breach.

Most of the Rules, including 6 and 7, commence 18 months after the November 2025 notification, which puts them in mid-May 2027. Sources cite 13 or 14 May, so confirm the exact day with your counsel. See also our guides on DPDP breach notification requirements and DPDP penalties and enforcement.

Three clocks start together when you become aware of a breach. Two of them become law in May 2027.

Lessons from other recent banking incidents

SBI is not an outlier. Business Standard’s roundup shows how different the causes can be.

An illustrative scenario: a lending startup

This is a hypothetical, not a real case. A mid-size lending startup shares loan enquiry data with three sourcing partners through a shared drive. One partner’s employee account is compromised. A week later, a security researcher emails: your leads are on a forum.

Who owns that data? Which systems feed the drive? Which partners hold copies, and what does each contract say about breach notice? Companies with a live data inventory and a vendor register answer in minutes. Companies without one spend the first 24 hours building the list, and the clocks are already running.

Six steps for your business this quarter

1. Map where personal data lives. List every system, owner and category. You cannot scope a breach you cannot see.
2. Build a vendor register. Record who processes data for you, what they touch, and whether a data processing agreement is in place and current.
3. Write a breach runbook with three clocks. Six hours for CERT-In today, plus Board and individual notice from May 2027. Name the person who decides at each step.
4. Pre-draft customer notices. Plain language, what was exposed, what to watch for, how to reach you. Writing these at 2 a.m. goes badly.
5. Run a tabletop exercise. Test with a leaked-file scenario and note where decisions stall.
6. Keep evidence as you go. Timestamps, decisions and notices should be recorded when they happen, not reconstructed later.

Common mistakes after a breach

• Treating a stock exchange or regulator filing as customer notification. They serve different audiences.
• Assuming a small leak does not count. The DPDP Rules apply no minimum size.
• Waiting for a vendor to call. SBI learnt of its exposure from outside alerts, after the data was already circulating. Monitoring is your job too.
• Waiting for 2027. CERT-In’s six-hour direction is already in force.

Where RuleExpert fits

Software does not stop a breach, and it does not replace legal advice or your security team. What it can do is remove the scramble from the response. RuleExpert’s Breach Management module is built to declare, scope and notify against the Rule 7 clock. Vendor Governance keeps a processor register with agreement status and risk scoring, and the Data Registry maps which systems hold which data.

If you are unsure where you stand, start with the free DPDP Scorecard. If you would rather see the workflow, you can book a RuleExpert demo. Our Breach Readiness and Response service is there if you want people alongside the platform.

Frequently asked questions

Was SBI hacked?

SBI has confirmed that customer records were found on the dark web and is investigating the source. It has not publicly stated how the data left its environment. Until the independent investigation reports, the cause remains unconfirmed.

How many SBI customers were affected?

SBI identified 3,897 customer records containing personal information out of about 3.75 lakh records reviewed. The final number could change, because the bank is still verifying authenticity, completeness and extent.

What SBI customer data was leaked?

Reports of the filing list names, mobile numbers, dates of birth, gender, email and home addresses, branch and customer identification details, and metadata linked to loan and lead records.

Are my SBI account and money safe?

SBI says the incident has no material impact on core operations. Customers should still be careful with calls or messages quoting personal or loan details, never share OTPs or PINs, and report unauthorised transactions to their bank and to 1930.

Is a bank required to tell customers about a data breach?

Not under a binding statute today. RBI Advisory No. 3/2026 recommends customer notification, and the DPDP Act will make individual notice mandatory for all Data Fiduciaries from May 2027.

What is the DPDP breach reporting deadline?

Under Rule 7, intimate the Data Protection Board without delay, then file detailed particulars within 72 hours, unless the Board extends the period. Affected individuals must be told without delay. The rule commences in May 2027.

Does the DPDP Act apply to the SBI incident?

Its breach provisions had not yet commenced when the incident was disclosed. Existing obligations such as CERT-In’s six-hour reporting and RBI and SEBI requirements apply instead.

What is the penalty for failing to report a breach under the DPDP Act?

The Act’s Schedule provides for penalties of up to ₹200 crore for failing to notify a breach and up to ₹250 crore for failing to take reasonable security safeguards. The Data Protection Board decides actual amounts.

Does a small business need a breach response plan?

Yes. The DPDP Act has no revenue or headcount threshold, and CERT-In’s directions cover body corporates broadly. A short runbook, a data inventory and a vendor list are a sensible starting point.

How can a company detect a breach early?

Combine access logging, alerts on unusual downloads, dark-web monitoring through a threat intelligence provider, and a clear route for outsiders to report issues. SBI’s own alerts came from such sources.