SBI Data Leak: Bank Reaches Out to Affected Customers, Affirms Funds Are Safe

On October 23, the State Bank of India (SBI) finally spoke up about a data incident that has been making the rounds on the internet. In a plain‑language statement titled “Customer Safety & Awareness – Important Update,” the lender said it has personally contacted every customer whose details appeared in a dark‑web dump.

Those notifications came through the channels most people use every day – email and WhatsApp. It’s a little odd to get a bank’s warning on a chat app, but SBI figured a direct message would cut through the noise and reach the right eyes quickly.

What exactly leaked? The bank’s own preliminary analysis, done on roughly 375,000 records, singled out 3,897 entries that contained personal information – names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses. In addition, the data set included branch identifiers, Customer Information File (CIF) numbers and some loan‑related metadata.

How did the leak come to light? SBI says it received alerts on October 16 from its threat‑intelligence partner, the Defence Cyber Agency, as well as from the Indian Computer Emergency Response Team (CERT‑In). Those alerts warned that a cache of SBI customer data was surfacing on the dark web.

Crucially, the bank stresses that the breach has not touched its core banking operations. "The Bank’s core business functions continue to operate normally without disruptions," the statement reads. No funds have been frozen, no transactions halted – just a lot of heads shaking.

Even though the money is safe, SBI is earnest about the risk of social engineering. With names, phone numbers and even partial addresses out there, scammers could craft convincing phishing calls or messages. The bank therefore urges everyone not to share OTPs, PINs or passwords with anyone, no matter how official the caller sounds.

In plain terms: if you get a call saying “we need your OTP to verify a transaction,” hang up and call the bank back on the number on the back of your card. Don’t click on links in unexpected emails, and double‑check any request for sensitive details.

The bank has already activated its cyber‑incident response plan and brought in an independent cybersecurity firm, appointed by CERT‑In, to dig deeper. The investigation is still ongoing, and SBI admits that the exact source and full scope of the leak remain unclear.

For the affected customers, the next steps are simple – keep an eye on your accounts, enable two‑factor authentication where possible, and report any suspicious activity straight away. As SBI puts it, “your account balances and funds are safe with us.”