SBI discloses dark-web exposure of 3,897 customer records; a CERT-In-empanelled agency is investigating

State Bank of India told the exchanges on October 21 that it has experienced an incident involving the loss of certain data. On October 16 the bank received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In about the suspected exposure of its customer data on the dark web. A preliminary analysis of approximately 375,000 records found there identified 3,897 customer records containing Personally Identifiable Information — roughly 1% of the records scanned so far. The bank says it activated its cyber incident response and containment protocols and has engaged an independent CERT-In-empanelled cybersecurity agency to assess and investigate the alleged compromise.

The list the filing gives is identity and contact data plus lead-file metadata. It does not state that account numbers, passwords, card details or transaction records were part of the exposed set — and it also does not state they were not; the stated purpose of the ongoing investigation is precisely to establish the completeness and extent of the exposure. If the exposed data proves authentic, the practical risk that names, mobile numbers, addresses and loan-lead identifiers carry is targeted phishing and impersonation of bank staff — that is an inference from the nature of the fields, not something the filing states.

Note what the statement covers and what it leaves open. It addresses operations, financials and continuity — it does not quantify customer-side risk, which the filing assigns to the detailed assessment that is "currently underway". The 3,897 figure is itself labelled preliminary: it is what a first pass over the ~375,000 dark-web records identified, and the investigation's stated scope includes determining whether the exposed data is authentic and complete.

1. 16 Oct

   Bank receives communications from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In: an alert on suspected exposure of customer data on the dark web.

2. 21 Oct

   Reg-30 disclosure reaches the exchange at 09:43 IST, during the session. Incident-response and containment protocols activated; an independent CERT-In-empanelled cybersecurity agency engaged.

The filing itself accounts for the five-day interval between alert and disclosure: a detailed investigation was required to establish the authenticity and completeness of the exposed data before the bank could characterise the incident. The disclosure was made under Regulation 30 of SEBI's Listing Obligations and Disclosure Requirements, the provision the filing cites.

In the session the filing landed, the stock closed at ₹972.30, down about 0.1% against the October 19 close of ₹973.70 — no discernible reaction in the price. The stock sits −21.3% below its adjusted 52-week high of ₹1,234.70 (February 24, 2026) and +7.9% above the 52-week low of ₹900.95 (October 24, 2025); that drawdown long predates this disclosure and cannot be attributed to it. The two sessions between alert and disclosure — October 16 and 19 — closed +0.3% and +1.2% respectively, with the alert not yet public.

The bank's assertion of no material financial impact sits against a consolidated net profit of ₹24,579 crore in the June 2026 quarter and a market capitalisation of roughly ₹8.97 lakh crore. The exposure disclosed here is an information-security event, not a financial one — the filing reports no monetary loss. The monitorable is therefore not this quarter's P&L but what the independent investigation establishes about the source and extent of the exposure, and whether the preliminary count of 3,897 holds as the remainder of the ~375,000 records is analysed.