Table of Contents
Introduction
An anonymous group has allegedly leaked sensitive customer data belonging to State Bank of India (SBI) account holders on a dark web forum, sending shockwaves through India’s banking and financial sector.
The leak was first identified on a deep web forum and was immediately flagged by cybersecurity researchers and threat intelligence teams actively monitoring underground criminal activity. The anonymous group has made the few stolen records freely accessible to anyone with dark web access, requiring no payment and no authentication to download.
The group claims it obtained over 375,000 records containing highly sensitive personal, financial, and banking details of SBI account holders across different states and cities in India.
This development is deeply alarming for millions of Indians who trust SBI – India’s largest public sector bank – with their most sensitive financial information every single day. If confirmed, this incident could become one of the most serious banking sector data breaches to hit India in 2026, with devastating consequences for affected account holders, their families, and the broader Indian financial ecosystem.
What Was Leaked?
The anonymous group publicly posted the alleged dataset on a dark web forum that global threat intelligence platforms and cybersecurity research teams actively monitor.
Dataset Overview
- Region: India
- Category: SBI Bank Customer Records
- Total Records: 375,000 rows
- Format: Raw Format
- Access Type: Only a few are Available
- Bank Identified: State Bank of India – SBIN
Leaked Data Allegedly Includes
Personal Identity Data
- Full customer names – first, middle, and last
- Date of birth and gender details
- Religion and marital status
- Education qualification details
- Salutation and category information
Banking and Financial Data
- Branch codes, branch names, and full branch addresses
- IFSC codes of associated SBI branches
- Annual income and occupation details
- Source of income information
Contact and Address Data
- Mobile phone numbers with ISD codes
- Personal email addresses
- Complete permanent home addresses
- Pincode, state, district, and sub-district details
Application and Verification Data
- Unique Lead IDs for each account application
- VKYC verification URLs – potentially still active
- Application creation and completion dates
- CKYC numbers where available
Security researchers flagged this listing immediately after it appeared online and are actively working to verify its full authenticity and scope.
Who Is Behind This Leak?
The group responsible for this leak identifies itself as an anonymous collective operating across dark web forums and underground criminal networks.
Who Is Affected?
This alleged breach directly impacts SBI account holders across multiple Indian states and cities.
State Bank of India serves over 500 million customers across India, making it the country’s single largest banking institution by customer base. A breach of this scale therefore carries implications that extend far beyond the immediate records exposed.
Potentially affected individuals include:
- SBI savings and current account holders whose applications appear in the dataset
- Customers who completed Video KYC verification through SBI’s digital onboarding platform
- Individuals whose CKYC numbers, income details, and family relation data appear in the leaked files
- Account holders across Gujarat, Andhra Pradesh, Delhi, Rajasthan, Maharashtra, Karnataka, and Punjab
Why SBI Customer Data Is Extremely Valuable on the Dark Web
State Bank of India customer records carry exceptional value on underground criminal markets for several specific reasons.
Above all, SBI is India’s largest and most trusted public sector bank. Its customer base spans every income group, profession, and geographic region across the country. This diversity makes SBI customer data useful for an extraordinarily wide range of criminal fraud operations.
Furthermore, the leaked dataset allegedly contains a remarkably complete combination of personal, financial, and banking data. Consequently, cybercriminals can exploit this information to launch multiple simultaneous fraud operations, including:
- Identity theft using verified personal details and date of birth information
- Banking fraud targeting account holders through phishing and social engineering attacks
- KYC fraud using leaked verification details to impersonate account holders
- Loan application fraud using stolen income and occupation data to apply for fraudulent credit
- SIM swap attacks using mobile numbers to bypass two-factor authentication
- Targeted phishing campaigns crafted using highly personal banking details
- Family targeting using relative names and relationship data for social engineering
VKYC URL Exposure – A Particularly Alarming Detail
One detail in this alleged breach demands special attention from cybersecurity professionals and SBI customers alike.
The leaked dataset allegedly contains active VKYC verification URLs for each affected account holder. VKYC, or Video Know Your Customer, is SBI’s digital identity verification system used during account opening and financial onboarding processes.
If these URLs remain active and unrevoked, they could potentially provide unauthorized access to sensitive identity verification sessions linked to real customer accounts.
SBI must therefore immediately audit and revoke all VKYC URLs associated with the affected lead IDs, without any further delay.
Regulatory and Legal Implications for India
This alleged breach carries serious regulatory consequences under India’s evolving data protection framework.
- Digital Personal Data Protection Act 2023 (DPDP Act) – Under India’s DPDP Act, organizations processing personal data must implement appropriate security measures and notify affected individuals and the Data Protection Board of India following a significant data breach. Non-compliance carries significant financial penalties.
- Reserve Bank of India (RBI) Cybersecurity Framework – As a regulated banking institution, SBI operates under strict RBI cybersecurity guidelines that require immediate incident reporting, customer notification, and forensic investigation following any confirmed data security event.
- CERT-In Reporting Obligations – Under CERT-In regulations, organizations must report cybersecurity incidents within 6 hours of discovery. SBI must notify CERT-In immediately if this breach is confirmed through forensic investigation.
What Should Affected SBI Customers Do Right Now?
If you believe your SBI account data may have been compromised, take these immediate protective steps:
- Contact SBI immediately on their official customer care number 1800-11-2211 to report potential compromise
- Change your SBI internet banking and mobile banking passwords without any delay
- Enable two-factor authentication on your SBI YONO app and internet banking account
- Monitor your bank account closely for any unauthorized transactions or suspicious activity
- Be alert for phishing calls and SMS messages claiming to be from SBI and referencing your personal details
- Never share OTPs, passwords, or account details with anyone claiming to represent SBI
- Check your email on HaveIBeenPwned.com for any associated credential exposure
- Report suspicious activity immediately to CERT-In at incident@cert-in.org.in
- Lodge a complaint with the RBI Banking Ombudsman if you suffer financial losses
Conclusion
The alleged leak of SBI Bank customer records by an anonymous group on the dark web is one of the most serious banking cybersecurity incidents to emerge from India in 2026.
State Bank of India serves as the financial backbone of hundreds of millions of Indian families. When sensitive data belonging to these account holders appears on dark web forums, freely accessible to criminals worldwide, the consequences extend far beyond individual financial loss.
This incident is a powerful reminder that India’s banking sector must treat cybersecurity as a non-negotiable national priority, investing aggressively in data protection, customer notification systems, and incident response capabilities that match the scale of the institutions they protect.