Nearly four thousand State Bank of India customers have had their names, dates of birth, home addresses and loan details circulating on the dark web since at least mid-October, yet nothing in the bank's official disclosure suggests any of them have been told. The gap between what SBI has confirmed to stock exchanges and what it has communicated to the people actually affected sits at the centre of a regulatory filing dated 21 October 2026, and it raises a question that goes well beyond one bank: who, under Indian law, is actually owed notice when a data breach happens?
What SBI Told the Market, and What It Left Out
The filing, made to the BSE and NSE under Regulation 30 of the SEBI Listing Obligations and Disclosure Requirements Regulations, 2015, describes an "Incident involving Data Loss." SBI says it learned of the exposure on 16 October through its threat intelligence vendor, the Defence Cyber Agency and CERT-In, after data had already surfaced on the dark web. A preliminary review of roughly 3.75 lakh records identified 3,897 customer records containing mobile numbers, dates of birth, addresses, CIF identifiers and loan-related details. SBI has engaged a CERT-In empanelled agency to investigate and says there is no material impact on its core business. That last point is a market disclosure, not a customer reassurance. It tells investors the bank's balance sheet is safe. It says nothing about whether the 3,897 individuals whose personal data is already public have received so much as a text message.
Why the Law Does Not Yet Require Notice
The reason SBI can file this disclosure without directly notifying customers is structural, not exceptional. Section 8(6) of the Digital Personal Data Protection Act, 2023 requires any data fiduciary to inform both the Data Protection Board and each affected individual when a breach occurs. Parliament passed this law in 2023. It will not take effect until May 2027, under a staggered commencement schedule the government has not revised despite a proposal floated by MeitY in January 2026 to shorten the timeline. Until then, breach reporting obligations run only to regulators: CERT-In requires notice within six hours under its 2022 directions, and the RBI's cyber security framework asks for an initial report within two to six hours. A bank can meet every one of these deadlines and still owe its customers nothing under current law. The RBI has tried to close part of this gap on its own. An advisory issued in March 2026 recommends that supervised entities notify affected customers through SMS, email, app alerts and calls, with remedial guidance and helpline support built into crisis response plans. It is advisory, not binding, and SBI's filing gives no indication it has been followed here.
Why Leaked Banking Data Is Especially Dangerous
The specific fields exposed matter more than their number. A fraudster who knows a customer's name, date of birth, branch, CIF number and loan details can impersonate a bank official convincingly enough to defeat the standard warning never to share an OTP. That warning assumes a customer can distinguish a genuine caller from an impostor. Leaked data erodes precisely that distinction, which is why notification is not a courtesy but a safety measure. The filing also leaves open what the remaining records in the 3.75 lakh contain, and makes no mention of the 2,722 PDF documents reportedly released by the threat actor behind the leak, which may include loan and account-opening paperwork carrying identity and address proofs. If genuine, the real number of affected people could be considerably higher than the 3,897 so far confirmed.
What Should Happen Next
A representation has been sent to SBI's Chairman, with copies to the RBI Governor and the Director General of CERT-In, asking the bank to notify every affected customer without delay, set up a verification helpline, disclose the full contents of the leaked dataset, and confirm whether compensation will follow under the RBI's customer liability rules. Until that happens, SBI account holders should treat any call or message referencing personal or loan details with suspicion, and verify unauthorised transactions through SBI's official helpline or the national cyber crime portal.
