SBI Data Breach: What to Do if Your Bank Records May Be Exposed

Last checked: Oct 20, 2026. SBI has not confirmed any breach. This post covers an unverified claim.

On October 16, 2026, a hacker group called Siriusim posted on the underground forum BreachForums claiming to be selling customer data from State Bank of India (SBI) or its subsidiaries. The claimed dataset includes 375,000 rows of customer information plus 2,722 PDFs of sensitive documents like loan applications, KYC records and account-opening forms.

SBI has not confirmed any breach. The claim's authenticity and whether SBI itself, a subsidiary, or a third party was the source remain unverified. Here's what's known, what's unconfirmed, and what SBI customers should do.

#What the hacker group claims

According to the BreachForums post flagged by security researcher CyberPulse56 on October 16, 2026, the claimed dataset contains:

The hacker group did not specify whether the data came from SBI directly, an SBI subsidiary, or a third-party vendor. The group made four sample files publicly available.

#What a newspaper verified

The Free Press Journal investigated the claim on October 17, 2026 and reported:

• The four public sample phone numbers were valid Indian phone numbers.
• For one sample, the person's WhatsApp profile picture matched the passport-size photograph on the same individual's KYC document in the claimed data.
• One document was an employment and income declaration listing the person's employer, designation and salary.

These findings suggest at least some of the sample files are authentic documents tied to real people. They do not confirm that SBI was breached, how many records are real, or where the data came from.

#SBI has not confirmed

As of October 20, 2026, State Bank of India has not responded to the claim or issued a breach notification. The bank has not said whether it is investigating.

Until SBI makes a statement, treat this as an unverified claim. Do not assume your data is in the set, and do not assume it is not.

#Why this claim is getting attention

1. SBI is India's largest bank, with more than 520 million (52 crore) customer accounts according to its FY25 annual report.
2. The forms are personal. KYC documents include passport photos, addresses and identity proofs. Income declarations show salary details. These are documents you hand your bank to open accounts or apply for loans.
3. One verification detail is unsettling. The Free Press Journal's finding that a WhatsApp profile photo matched a KYC photo for one sample suggests the dataset ties people's real faces, contact details and financial records together.
4. Mainstream coverage grew fast. Posts on X (formerly Twitter) matching "SBI" or "State Bank of India" with "breach," "hack" or "leak" jumped from fewer than 20 per day on October 14-18 to 87 on October 20 as outlets like India Today, Economic Times, Moneycontrol, NDTV Profit and ET Now reported the claim.

The claim has not been independently verified beyond the Free Press Journal's sample check.

#What to do if you're an SBI customer

You can't undo a form you already signed, but you can watch for misuse and protect what's still under your control. Follow these steps whether or not your data was exposed, because the risk from phishing and scams applies to every SBI customer once a claim like this circulates.

#1. Watch for KYC and loan phishing

Scammers monitor breach claims and tailor their messages to what leaked. Expect texts, emails and calls that reference your KYC update, your loan application, or a "security issue" with your SBI account.

Red flags:

• "Your KYC is expiring. Click here to update."
• "We found suspicious activity on your loan account. Verify now."
• Messages asking you to upload your Aadhaar, PAN, or a photo again.
• Calls claiming to be from SBI and asking for your ATM PIN, OTP, or CVV.

The rule: Never click links in unsolicited messages. Go to SBI's official site, app or branch yourself. SBI will never ask for your PIN, OTP or CVV.

#2. Enable SMS and email alerts

Turn on transaction alerts for your SBI accounts so you know immediately if a withdrawal, transfer or purchase happens. Most banks offer free SMS alerts for transactions above a threshold you set.

In SBI's internet banking or mobile app:

1. Go to Profile or e-Services.
2. Look for Alert / Notification Settings.
3. Enable SMS and email alerts for transactions, balance changes and failed login attempts.

#3. Check your credit report

If someone uses your details to apply for a loan in your name, it will show up on your credit report. Check your report at CIBIL (cibil.com), India's largest credit bureau, or through Experian or Equifax India.

You're entitled to one free report per year from CIBIL. Look for:

• Loan accounts or credit cards you don't recognize.
• Hard inquiries from lenders you didn't apply to.
• Addresses you never lived at.

If you find something wrong, dispute it with the bureau and file a complaint with your bank.

#4. If you see suspicious activity, dispute and lock what you can

Indian credit bureaus don't offer a US-style consumer credit freeze, but you can still protect yourself:

If you spot an unauthorized loan inquiry or account:

1. Dispute it with the credit bureau. File a dispute with CIBIL, Experian India or Equifax India through their websites or customer service. They're required to investigate and correct errors.
2. Report it to your bank immediately. Ask them to flag your account and block any fraudulent applications.
3. Use account controls where available. Many banks' mobile apps let you lock your debit card, set transaction limits, disable international transactions, or pause online payments. SBI's YONO app and net banking offer card controls under the "Card Services" section.

If you're not sure whether an inquiry is fraudulent, call the lender shown on your report directly using the number from their official website, not from the report itself.

#5. Review your SBI accounts and statements

Log in to SBI internet banking or your mobile app and review recent transactions. Look for:

• Withdrawals or transfers you didn't make.
• Changes to your registered mobile number or email.
• Beneficiaries added that you don't recognize.

If you find anything suspicious, call SBI customer care immediately (the number is on the back of your debit card or on sbi.co.in) or visit your branch.

#6. Change your password and enable two-factor authentication

Even though this claim involves documents, not online credentials, it's a good time to secure your SBI internet banking and mobile app:

• Use a long, unique password.
• Turn on two-factor authentication (2FA) if SBI offers it for your account type.
• Never reuse your banking password on other sites.

#7. Don't upload your documents again unless you initiate it

If someone contacts you claiming you need to "re-verify" your KYC or "resubmit" your loan documents, ignore it. SBI will notify you through official channels if there's a real KYC update requirement, and you should go to your branch or the official SBI site yourself.

Uploading your documents to a fake site hands scammers exactly what they claim is already leaked.

#A fictional example

Priya Sharma, a software engineer in Pune, has had an SBI savings account since 2018 and took a home loan in 2022. When she saw the breach claim on October 20, she:

1. Turned on SMS alerts for every transaction over ₹500.
2. Checked her CIBIL report and saw no unfamiliar inquiries.
3. Reviewed her SBI account transaction history for the last three months and found nothing unusual.
4. Changed her internet banking password and made sure it was unique.
5. Saved SBI customer care's number in her phone so she'd recognize a real call.

Three days later, Priya got a text: "Your KYC update is pending. Complete now: [link]." She deleted it and did not click. Two weeks after that, she logged in to SBI's site herself to check whether a real KYC update was required. There wasn't one.

#What makes SBI customers vulnerable even without a confirmed breach

Data from old breaches, public records and data brokers builds up over time. People-search sites list phone numbers and addresses. Scammers buy or scrape that data and use it to make phishing more convincing.

A claim like this one, even if unverified, gives scammers a story: "We're reaching out because of the recent SBI data incident..." That line, combined with your real phone number or name, makes the message feel legitimate.

UndoLeak erases your data from data brokers and keeps it off. Fewer listings mean fewer contact details scammers can use to reach you. Run our free people-search check to see where your phone number and address are listed, then opt out.

#How bank document leaks happen

When documents like KYC forms or loan applications leak, the source is usually:

The Siriusim claim does not specify which. Until SBI or an investigation clarifies, the source is unknown.

#Timeline

#If SBI confirms a breach

If SBI issues a statement confirming a breach and notifying affected customers, follow the bank's instructions. Typically, banks will:

• Tell you which data was exposed.
• Offer free credit monitoring or identity protection services.
• Give you a direct contact for questions.

Keep the official notification email or letter. You may need it if you have to dispute fraudulent accounts later.

Even if SBI confirms, the protective steps above still apply.

#Where to report fraud

If someone uses your information to open an account, take a loan, or commit fraud:

1. File a police complaint (FIR) at your local police station or online through your state's cybercrime portal.
2. Report it to your bank and ask them to flag your account.
3. Notify the credit bureau (CIBIL, Experian or Equifax India) and dispute the fraudulent entry.
4. File a complaint with RBI (Reserve Bank of India) through its CMS (Complaint Management System) portal: cms.rbi.org.in.

Document everything: screenshots, emails, transaction records, dates and times.

#Sources

1. The Free Press Journal, "SBI, subsidiaries' customer data allegedly on dark web; 3.75 lakh records, 2,722 documents claimed in data breach" (Oct 17, 2026). https://www.freepressjournal.in/business/sbi-subsidiaries-customer-data-allegedly-on-dark-web-375-lakh-records-2722-documents-claimed-in-data-breach
2. India Today, "SBI data breach reported: Hacker claims sensitive info including KYC records of 3.75 lakh users at risk" (Oct 19, 2026). https://www.indiatoday.in/technology/news/story/sbi-data-breach-reported-hacker-claims-sensitive-info-including-kyc-records-of-375-lakh-users-at-risk-3020636-2026-10-19
3. Moneycontrol, "SBI data breach claim: Hacker group alleges access to 3.75 lakh records, 2,722 documents" (Oct 20, 2026). https://www.moneycontrol.com/news/business/sbi-data-breach-claim-hacker-group-alleges-access-to-3-75-lakh-records-2-722-documents-14056008.html
4. Economic Times, "SBI data breach claim: Hackers allegedly access 3.75 lakh accounts" (Oct 20, 2026). https://economictimes.indiatimes.com/industry/banking/finance/banking/sbi-data-breach-claim-hackers-allegedly-access-3-75-lakh-accounts/articleshow/135055988.cms
5. CyberPulse56 on X (Oct 16, 2026). https://x.com/CyberPulse56/status/2111026143130526105
6. State Bank of India, "About Us" (52 crore customers, FY25 annual report). https://sbi.co.in/
7. CIBIL (credit reports). https://www.cibil.com/
8. Reserve Bank of India, Complaint Management System. https://cms.rbi.org.in/

Priya Sharma and her details are fictional.