SBI says 3,897 customer records with personal data found on dark web

State Bank of India told the stock exchanges on October 21, 2026 that it had suffered an incident involving the loss of certain data, and that a preliminary analysis of roughly 3,75,000 records available on the dark web had identified 3,897 customer records containing personally identifiable information (The Hindu BusinessLine, Hindustan Times, The Times of India). The bank said it was alerted on October 16 by its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In, activated its cyber incident response and engaged an independent agency empanelled with CERT-In to establish the authenticity, source and extent of the exposure (Business Today, O Heraldo, The Times of India).

What every report agrees on

Every report draws on the same exchange filing: the alert reached SBI on October 16, the disclosure came on October 21, and preliminary analysis of about 3.75 lakh records on the dark web yielded 3,897 records with personally identifiable information (The Hindu BusinessLine, The Sentinel, Business Today, PSU Watch). Reports list the exposed fields as names, registered mobile numbers, dates of birth, gender, email addresses and residential addresses, with branch and customer identifier details and loan-lead information also cited (ABP Live, Scroll.in, Mint). All agree the bank has brought in an independent CERT-In-empanelled cybersecurity agency and that the investigation into the nature and extent of the compromise is continuing (Mathrubhumi, Pratidin Time, The Economic Times). The bank's statement that the incident has no material impact on core business operations, financial performance or business continuity is reported across outlets (PSU Watch, Mint).

How the left-leaning press told it

Hindustan Times, The New Indian Express, Scroll.in and The Hindu: Accountability and unanswered scope

Left-leaning outlets carried the filing but pressed on what it leaves out. Hindustan Times, rated centre-left, noted that the disclosure does not say what the remaining records contain, whether they relate to SBI customers, or how many people they cover (Hindustan Times). The New Indian Express, rated centre-left, led on Congress saying the bank owes its customers answers and that those responsible must be held accountable (The New Indian Express). Scroll.in, also rated centre-left, reported the incident as a cyberattack and relayed the bank's account of the leaked fields without added comment (Scroll.in), while The Hindu set out the timeline and turned to what customers should do (The Hindu).

How the right-leaning press told it

The Economic Times, The Times of India and ABP Live: Filing, probe, customer reassurance

Outlets rated centre-right reported the filing as a disclosure-and-probe story. The Economic Times said the lender had initiated a cyber incident response and engaged an independent agency to investigate the nature and extent of the alleged compromise (The Economic Times). The Times of India summarised what was known so far from the exchange filing, including the October 16 communications and the launch of a detailed investigation (The Times of India). ABP Live framed its report around whether customers' information is safe, setting out the exposed fields drawn from the filing (ABP Live).

How the centre told it

Mint: Cyberattack confirmed, probe under way

Mint, rated centre, reported the incident as a confirmed cyberattack affecting about 3,900 customer records, listing personal details and loan records among the exposed data (Mint). It noted the appointment of an independent cybersecurity agency and the bank's statement that the incident is not expected to materially affect operations (Mint).

What the record shows

The documentary basis in every report is SBI's October 21 filing with the stock exchanges (The Hindu BusinessLine, Hindustan Times). It records communications received on October 16 from the bank's Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In (Business Today, The Hindu), a preliminary count of 3,897 records with personally identifiable information out of about 3,75,000 records seen on the dark web (The Sentinel), and the engagement of a CERT-In-empanelled agency (O Heraldo). The filing's assertion of no material impact on operations, financial performance or business continuity is also on the record (PSU Watch, Mint). What the reports do not settle is the content and ownership of the balance of the 3.75 lakh records, which Hindustan Times says the disclosure does not explain (Hindustan Times), and the source and authenticity of the exposure, which the bank itself says remain under investigation (The Economic Times, The Times of India). Congress's demand for answers and accountability is reported as a political response, not as a finding (The New Indian Express).

Drafted by the Alethman engine from 16 independent reports, and checked by an editor before publication. An outlet's side comes from published media-bias ratings (Media Bias/Fact Check, AllSides) or documented ownership, named under the coverage bar; Alethman does not rate outlets itself.