State Bank of India (SBI), the country's largest lender, has confirmed a data exposure incident that put 3,897 customer records containing personally identifiable information on the dark web. In a regulatory filing, the bank stated it received alerts on October 16, 2026 from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about suspected customer data exposure. A preliminary examination of around 3.75 lakh records found on the dark web identified the affected customer records, which reportedly included names, mobile numbers, dates of birth, email addresses, residential addresses, branch and CIF identifiers, lead IDs and metadata associated with loan/lead records and other related files. The bank has activated its cyber incident response and containment measures and engaged a CERT-In-approved independent cybersecurity firm to assess the reported breach and potential risks to customers and the lender.
SBI is now assessing the extent of the incident and potential losses before filing a claim under its cyber insurance policy, according to The Economic Times. The bank may seek a payout under its ₹1,425-crore cyber insurance policy with Oriental Insurance, with the amount dependent on the losses covered under the policy terms and conditions. As reported by The Economic Times, SBI is in the process of notifying the insurer about the claim, though both SBI and Oriental Insurance did not respond to requests for comment. Any insurance claim would depend on the policy's terms and conditions, the nature of the incident and the losses found to be covered, with the ₹1,425-crore limit representing the coverage ceiling. An insurance broker noted that a well-drafted cyber insurance policy may cover certain liabilities and expenses arising from data protection law violations, though coverage for regulatory fines can be subject to restrictions and exclusions.
The SBI incident represents the latest in a growing number of cyber security breaches involving Indian banks and their technology providers, with digital-payment frauds accounting for the largest number of bank fraud cases according to RBI data. As reported by Business Standard, CERT-In has warned of attacks on non-banking financial companies (NBFCs), digital lenders, fintechs, payment-service providers, and wallets. The threat landscape has become increasingly sophisticated, with artificial intelligence (AI) agents now accessing live systems and confidential records of Indian organisations without authorisation, with none of the affected organisations detecting the access themselves. Attackers are using agentic AI tools for financially motivated intrusions, making conventional weaknesses like exposed credentials, poorly secured application programming interfaces (APIs), and excessive cloud permissions considerably more dangerous when machines can exploit them at speed and scale.
The SBI incident joins a series of significant cybersecurity incidents affecting major Indian banks. The Bank of Baroda disclosed a cybersecurity incident involving business email compromise in July 2026, with the dataset advertised on a dark-web site as containing more than 700GB of information. ICICI Bank has faced multiple challenges, including a BASHE ransomware claim in January 2025 and a ₹97.80 lakh RBI penalty in April 2025 for non-compliance with cyber security guidelines. In April 2024, ICICI Bank incorrectly mapped about 17,000 newly issued credit cards to wrong users, with customers reporting technical glitches displaying other customers' card details.
Despite existing cybersecurity frameworks under RBI and the Digital Personal Data Protection (DPDP) Act 2023, significant regulatory gaps remain. The DPDP provisions are subject to staggered commencement, with principal breach-notification provisions taking effect only 18 months after November 2025 notification. Business Standard editorial suggests that regulated entities should be mandated to notify affected customers promptly when there is credible evidence of material personal-data exposure, without waiting for complete investigation details. Banks and financial firms should be held to enforceable standards on API security, third-party risk, cloud access, and AI-agent permissions, with CERT-In's guidance on limiting agent access and maintaining tamper-resistant logs becoming operational practice rather than mere advice.
