SBI data breach: Bank contacts affected customers on WhatsApp, email, says money is safe
The update comes days after India’s largest public sector bank disclosed a suspected data leak involving nearly 3.75 lakh records found on the dark web. Of these, SBI’s preliminary investigation identified 3,897 customer records containing personal information, including names, phone numbers, addresses and loan-related details. The incident has raised concerns about how criminals could misuse the exposed information.
https://t.co/lrIZtM5nnQ
— State Bank of India (@TheOfficialSBI) October 23, 2026
SBI confirms affected customers have been contacted
In its latest statement, SBI said, “Further to our earlier post regarding the recent cyber incident, the Bank has individually informed all customers whose data was identified as being involved through email and/or WhatsApp. We reiterate that your account balances and funds are safe with us.”
This means customers identified during the bank’s investigation should already have received a message through at least one of these channels.
SBI has maintained that the incident has not materially affected its banking operations or financial performance.
What information was leaked in the SBI cyberattack?
According to SBI’s October 21 regulatory disclosure, the bank received alerts about the suspected exposure on October 16 from CERT-In, the Defence Cyber Agency and its threat intelligence provider.
An initial investigation identified the following information among the exposed records.
| Information | Reported exposure |
|---|---|
| Customer names and dates of birth | Yes |
| Mobile numbers and email addresses | Yes |
| Residential addresses | Yes |
| Branch and customer identifiers | Yes |
| Loan-related information | Yes |
| Account balances and funds | SBI says funds are safe |
The bank has appointed an independent cybersecurity agency to investigate the source and extent of the incident.
Read our full report on the SBI data breach:
Should SBI customers be worried?
The immediate concern is the possible misuse of personal information. Criminals could use leaked phone numbers, addresses or loan details to make fraudulent calls and messages sound convincing.
Customers receiving WhatsApp or email notifications should verify them through SBI’s official channels. They should avoid clicking suspicious links or sharing OTPs, passwords and banking PINs.
SBI says customer funds remain safe. The investigation into the origin and full extent of the exposed data is continuing.