Nearly four thousand State Bank of India customers have had their names, dates of birth, home addresses and loan details surface on the dark web, yet none of them appear to have heard this from the bank itself. SBI told the BSE and NSE on 21 October 2026 that it had suffered what it called an "incident involving data loss." The filing satisfies a stock market disclosure rule. It does not, on its own terms, amount to telling a single affected person that their personal information is circulating outside the bank's control.
What the Filing Says, and What It Leaves Out
SBI's Regulation 30 disclosure states that on 16 October it received alerts from its threat intelligence vendor, the Defence Cyber Agency and CERT-In about suspected exposure of customer data on the dark web. Out of roughly 3.75 lakh records found there, the bank says a preliminary review identified 3,897 customer records containing mobile numbers, dates of birth, names, addresses, CIF identifiers and loan-related metadata. It has engaged a CERT-In empanelled agency to investigate and insists there is no material impact on its core operations or financial standing. What the filing does not explain is what the remaining records contain, whether a separate cache of 2,722 PDF documents reported by a threat actor includes identity or address proofs, or how the data left the bank in the first place. A disclosure built to reassure investors says nothing about the people whose details are actually at risk.
Why Notification Is Not Yet a Legal Requirement
The gap between disclosing to markets and notifying customers is not an oversight; it reflects a genuine regulatory lag. Section 8(6) of the Digital Personal Data Protection Act, 2023 would require SBI, as a data fiduciary, to inform both the Data Protection Board and every affected individual of a breach. That provision, passed by Parliament more than three years ago, will not come into force until May 2027 under the government's staggered commencement schedule. Until then, the bank's binding obligations run only to regulators: CERT-In requires reporting within six hours under its 2022 directions, and the RBI's cyber security framework expects an initial report within two to six hours. Both can be satisfied while the customer remains unaware that their CIF number and loan history are posted for sale.
A Standard the RBI Has Already Set
The Reserve Bank has not waited for Parliament's timeline. Its Department of Supervision issued an advisory in March 2026 recommending that supervised entities notify affected customers through SMS, email, app alerts and calls, with guidance on remedial steps built into their cyber crisis plans. It is advisory rather than mandatory, which is precisely the weakness this incident exposes: a well-written recommendation carries no consequence for a bank that simply does not follow it. The Puttaswamy judgment recognised informational privacy as a constitutional right in 2017; that principle argues for notification as a baseline obligation, not a discretionary courtesy, especially for an institution holding the financial data of hundreds of millions of depositors.
Why This Matters for Fraud, Not Just Privacy
Banking fraud in India increasingly depends on impersonation that sounds credible. A caller who already knows a customer's name, date of birth, branch and outstanding loan amount does not need to guess at an OTP; the data itself lends false legitimacy to the call. Standard advice against sharing one-time passwords assumes customers can distinguish a scammer from their bank. Leaked records erode precisely that distinction, and only direct notice from SBI restores it. Until the bank discloses the full scope of what was exposed, how it happened and who exactly is affected, the 3,897 identified customers, and potentially many more, remain exposed without being told, and without the warning that might help them recognise the fraud attempt likely to follow.