The SBI data breach claim has worried millions of customers of India's largest bank. A hacker group says it has stolen customer records linked to the State Bank of India (SBI) and put them up on a dark web forum. Some early posts mentioned only a few thousand records, which has caused confusion. This article explains in simple words what is actually being claimed, what has been checked, what has not, and what you should do right now.
What Is the Alleged SBI Data Leak?
On or about October 16, 2026, an account named “CyberPulse56,” which was dedicated to cybersecurity, posted on BreachForums, an online forum popular with cybercriminals for trading in stolen data. The post came from a threat actor using the name "Siriusim".
The hacker claims to hold about 375,000 customer records and 2,722 PDF documents linked to SBI and possibly its subsidiaries. To prove the claim, the hacker shared four sample customer records for free. India Today Tech reported on the matter on October 19, 2026.
Is It 4,000 Records or 375,000?
You may have seen the number "4,000" online. It does not match the current claim. Two things are likely behind the mix-up:
The hacker posted only four sample records as proof, which is easy to confuse with 4,000.
An older, separate story about SBI described more than 4,000 employee records being leaked, along with claims about 12,000 employees. That is a different incident.
The figure in the current claim is 375,000 customer records, and that number comes from the hacker, not from SBI.
What Kind of Data Is Said to Be Exposed?
According to reports, the files are mainly connected to loan applications. The data is said to include:
Loan applications and supporting financial documents
Account opening forms
Customer identification details
Residential addresses
Some savings account and customer acquisition details
Some coverage also says the dataset may include KYC records and Aadhaar numbers. Notably, the samples reportedly included both CKYC records (the central KYC registry) and VKYC records (identity checks done over video call). That makes this claim more serious than a simple leak of names and phone numbers.
Has the SBI Data Breach Been Verified?
Not officially. As of the latest reports, SBI has not published a statement confirming or denying the leak. It is also unclear how the hacker got the data, and whether the records are new or taken from an older incident.
There is one worrying sign. The Free Press Journal reportedly checked the public samples and found that the phone numbers were active and that WhatsApp profile photos matched the faces in the KYC documents. That suggests the samples may be genuine, though it does not prove the full 375,000-record claim.
The safest way to read this story is: a serious claim, partly supported by checks on the samples, but not confirmed by the bank. A post on a hacker forum is not proof of a breach on its own, and hackers sometimes exaggerate or reuse old data.
Why a KYC Leak Is So Dangerous
If the data is real, the risk goes beyond spam calls. KYC documents are what banks use to confirm who you are. They can be used for: in the wrong hands
Identity theft – open false accounts, loans or SIM cards in your name.
TaTargeted phishing Scammers who have your loan details and address can be very convincing on a call or WhatsApp.
Financial fraud: fake “bank officials” may use real details to gain your trust and request OTPs or payments.
Cybersecurity experts warn that even unverified leaks can fuel these scams, because criminals start using the data quickly.
This Is Not the First Bank Data Scare
Indian banks have faced several data incidents. In July 2026, Bank of Baroda acknowledged a major leak reported to involve about 1TB of data. Years earlier, TechCrunch reported that an SBI server holding SBI Quick text-message data was left open without a password, exposing customer information until the bank secured it. These cases show why banks need strong access controls and encryption, and why customers should stay alert.
How to Protect Yourself After the SBI Data Breach Claim
You do not need to panic, but a few habits can greatly lower your risk:
1. Never share OTPs, PINs or passwords. SBI staff will not ask for them by call, SMS or WhatsApp.
2. Beware of loan or address reference calls. Scammers can use leaked information to present themselves as real.“Cut the line and call SBI on the number printed on its official website or your card.”
3. Check your account regularly.Turn on sms and app alerts. Check statements and report any unknown transactions as soon as possible.
4. Only official SBI app & website to be used.Do not click on links in messages or on social media .
5. Check your credit report.Unsolicited loan inquiries are an early warning sign of identity theft.
6. Report fraud swiftly. Report to national cybercrime helpline 1930 or file complaint at cybercrime.gov.in.The faster, the better chance to stop a fraudulent transfer.
7. Any Statement or advisory on the incident will be issued through SBI’s official channels.
Conclusion
The alleged SBI data breach is a developing story. A hacker group says it holds 375,000 customer records, including loan files and identity documents, and has shown four samples as proof. Early checks by media suggest the samples may be real, but SBI has not confirmed the claim, and the source and age of the data remain unknown. Until the bank speaks, the smart move is simple: stay alert to scam calls, never share OTPs, monitor your account, and report anything suspicious quickly.
Frequently Asked Questions
Has SBI confirmed the data breach?
No official confirmation had been reported at the time of writing. For updates, visit SBI’s official website and social media handles.
How many customers are affected?
Hacker claims 375,000 customer records exposed.This number is unverified and the actual number could be higher, lower or based on old data.
Is my SBI account money secure?
That claim is not about passwords or account balances, but documents and personal details mostly from loan-related files.Still, leaked personal info can help scammers to con people. So, stay careful.
Change SBI Password or Not?
It’s a good precaution, especially if you’re reusing passwords across sites.Never give the new password to anyone.
Where do I report suspected fraud?
Call 1930 or visit cybercrime.gov.in. Immediately inform your bank branch.
Sources:
https://thehackernews.com/2026/10/state-bank-of-india-confirms-data-leak.html