SBI Data Breach 2026: 3,897 Customers Confirmed, 3.75 Lakh Records Claimed, and the Question Nobody Has Answered Yet

The short version

• A threat actor called "Siriusim" claims to have leaked about 3.75 lakh CSV rows and 2,722 PDFs linked to SBI (BusinessToday, 20 Oct 2026). This is a claim, and it is not independently verified.
• SBI told the stock exchanges on 21 Oct that it has "experienced an incident involving the loss of certain data." Its preliminary review found 3,897 customer records with personal information inside a set of about 375,000 records (The Hacker News).
• The bank was alerted on 16 October by its threat intelligence provider, CERT-In and the Defence Cyber Agency. Public disclosure came on 21 October (Newsgram).
• The listed fields are names, mobile numbers, dates of birth, gender, emails, addresses, branch and CIF identifiers, and loan or lead metadata. Account numbers, balances, passwords, OTPs, card details, PAN and Aadhaar are not on the list (The Hacker News).
• The source, the cause and the full extent are not known. I don't know whether the number will grow.

Confirmed vs claimed

Two things to watch in reports. Some headlines say "3.75 lakh customers leaked." BusinessToday itself notes the rows may include duplicates and may not equal 375,000 people. One ETV Bharat link says "over 10%" of records had critical data, but its body text gives about 1% (3,897 of roughly 375,000). Quote the 3,897 figure with the word "preliminary."

Timeline

What the leak can and cannot do

The listed data has no passwords or OTPs. That does not make it harmless.

• Cannot (on current information): log into net banking or approve a UPI payment by itself. Those need credentials that SBI has not listed.
• Can: make a scam call sound real. A caller who knows your name, date of birth, branch and loan details sounds like the bank. The IFF warned that affected customers could be targeted by callers posing as SBI officials (Newsgram).
• Worst realistic path (my analysis): a fraudster uses your details to build trust, then asks for an OTP, a screen share or an app install. The leaked data is the setup, and the fraud needs you to take the last step.

Warning signs of follow-on fraud

• A call about "KYC update," "loan follow-up" or "your branch" that quotes your real details.
• A video call asking you to install an app or share your screen.
• Your phone suddenly losing network. This can mean a SIM swap, so contact your operator at once.
• Links or attachments on WhatsApp, SMS or email, however official they look.

Source for these patterns: CareerIndia's safety checklist. They also match common fraud advice, but CareerIndia does not independently verify the breach.

What to do now

Your rights if money is lost

Under the RBI's customer-liability framework, your loss is zero in a third-party breach if you report within 3 working days of the bank's communication. If you report in 4 to 7 working days, your liability is capped. For most savings accounts the cap is ₹10,000, or the transaction value if lower. The bank must credit the disputed amount within 10 working days (RBI master circular).

If you shared your OTP or PIN, the rule treats that as customer negligence and you bear the loss until you report. So report fast and never share credentials.

Will the DPDP Act help?

Less than you may have read. CareerIndia says the DPDP Act requires breach notification and a 72-hour board submission. The Act's phasing says otherwise for now:

• Phase I, in force since 13 Nov 2025: the Data Protection Board and procedural rules.
• Phase III, from 13 May 2027: the substantive duties on data fiduciaries and the Board's inquiry and penalty powers (AZB & Partners).
• AZB does not state the start date for breach notification separately. Since it is a fiduciary duty, it appears to start in May 2027. I have not confirmed this in the Rules text.

The IFF has asked MeitY to bring the Act's provisions into force and asked the RBI to direct banks to inform customers (Newsgram).

Could more leak out?

I don't know, and nobody outside the investigation does. What the public record shows:

• SBI's count is preliminary.
• The bank's review has not clearly covered the 2,722 PDFs.
• The cause is unknown, and the IFF wants to know whether a vendor or direct selling agent was involved.
• SBI first heard from outside agencies. It did not detect the breach itself.
• Another bank, Bank of Baroda, filed a similar disclosure on 27 July citing a "potential business email compromise" (The Hacker News).

Treat any number as provisional until SBI or CERT-In publishes the audit.

FAQs

1. Was my SBI account hacked?

There is no confirmation of account takeover. SBI says core systems are unaffected.

2. How do I know if I'm among the 3,897?

The filing does not say customers are being told directly. Check SBI's official notice and your registered email or SMS. Be careful with anyone who contacts you offering to "check" for you.

3. Are my balance, PIN or OTP leaked?

Not on the listed fields. This is the bank's disclosure, not independently verified.

4. Should I close my account?

Nothing in the reporting says so. The precautions above address the real risk.

5. Is the hacker's 3.75 lakh figure true?

Unverified.

6. Can someone take a loan in my name?

Leaked data raises identity-misuse risk. Check your credit report with CIBIL or another bureau for unfamiliar loans. This is my general advice, not from the sources.

7. What if I get a call from "SBI"?

Hang up and call the number on the official website.

8. I lost money. What now?

Call 1930, file at cybercrime.gov.in, and tell the bank in writing within 3 working days.

9. Does the SBI app need updating?

I found no source saying an update is needed.

10. Is the DPDP Act protecting me now?

The substantive duties start May 2027, as far as I can tell.

11. Does this affect other banks?

I have no confirmed link. The reporting only compares past breaches.

12. Could a business's data be exposed this way?

Yes, when vendors or agents hold customer data. See the next section.

My honest take

• The headline gap (3,897 vs 3.75 lakh) is the story. Reporting that skips it is misleading in one direction or the other.
• The real risk now is the phone call, not the database.
• Five days from alert to public notice, with outside agencies spotting it first, is a fair question for the bank. The answer is not public yet.

If you run a business

The same pattern hits businesses: customer data held by vendors, agents and staff, and fraud calls that use it. Once the DPDP duties start in May 2027, a leak will carry legal consequences for the data holder. At Lawgical Station we are already discussing with clients how to map where their customer data sits and who can touch it. The team can walk you through it on a short call.

General information, not legal advice. The facts are as reported on 23 October 2026 and may change.