Nearly four thousand bank customers have had their names, dates of birth, addresses and loan details surface on the dark web, and the State Bank of India has told the stock exchanges rather than the people concerned. The disclosure, filed on 21 October 2026 under securities regulations, frames the episode as a non-event for investors. It says nothing about whether a single affected customer has been informed.
What the filing says, and what it leaves out
SBI's Regulation 30 filing with the BSE and NSE states that the bank learned on 16 October of suspected exposure of customer data on the dark web, through alerts from its threat intelligence vendor, the Defence Cyber Agency and CERT-In. A preliminary review of roughly 3.75 lakh records found there identified 3,897 customer records containing personally identifiable information, including mobile numbers, dates of birth, addresses, CIF identifiers and loan details. The bank says the incident has no material impact on its core business, and that it has engaged a CERT-In empanelled agency to investigate.
What the filing does not establish is the scope of the remaining records, or the status of the 2,722 PDF documents a threat actor had already claimed to have released days earlier on a social media platform monitored by cybersecurity watchers. Loan and account-opening files typically carry identity and address proofs. If those documents are genuine, the number of people exposed could run well beyond the 3,897 figure SBI has confirmed.
A regulatory gap that favours silence
India's data protection law, the Digital Personal Data Protection Act of 2023, requires a data fiduciary to notify both the Data Protection Board and every affected individual after a breach. That obligation, however, does not take effect until May 2027 under the government's staggered rollout of the law. Until then, the binding duties run toward regulators, not customers: CERT-In's directions require reporting within six hours, and the RBI's cyber security framework requires banks to flag incidents within a similarly tight window. A bank can satisfy every one of these timelines and still leave depositors unaware that their personal data is circulating publicly.
The Reserve Bank has already pointed supervised entities toward better practice. An advisory issued by its Department of Supervision in March 2026 recommends that banks notify affected customers through SMS, email, app alerts and calls, backed by helpline support. That advisory is not enforceable. SBI's own filing gives no indication that it has been followed in this case.
Why notice matters more than compliance
Banking fraud in India relies heavily on impersonation, and a caller armed with a customer's real name, date of birth, branch and loan details can sound convincingly official. The standard warning never to share an OTP assumes a customer can distinguish a genuine bank call from a fraudulent one. A leak of this kind erodes exactly that distinction, which is why notification is not a courtesy but a safeguard. The right to informational privacy, recognised by the Supreme Court in its 2017 Puttaswamy judgment, arguably demands nothing less.
A formal representation has been sent to SBI's Chairman, with copies to the RBI Governor and CERT-In's Director General, asking the bank to notify every affected customer directly, disclose the full contents and scope of the leaked dataset, explain how the data left its systems, and confirm that any resulting financial loss will be compensated under existing customer liability rules. The RBI has separately been asked to make customer notification mandatory for regulated entities pending the delayed provisions of the DPDP Act.
Customers of SBI should treat unsolicited calls, SMS or WhatsApp messages referencing personal or loan details with suspicion, and report unauthorised transactions to the bank's helpline or the national cyber crime helpline at 1930.