SBI Data Leak 2026: What Actually Leaked, What Didn't — and the Call You Should Expect

Short answer: Yes, it happened. SBI told the stock exchanges on 21 October 2026 that 3,897 records with customers’ personal details had been found, so far, in a dark-web set of about 3.75 lakh records. The leaked fields are names, mobile numbers, birth dates, addresses, branch and internal customer IDs, and loan-enquiry data. No OTPs, PINs, card details, account numbers, PAN or Aadhaar are on the list. Your account cannot be emptied with this. What it can do is make a stranger sound exactly like your bank.

The misconception: “my data leaked, so my money is gone”

That isn’t how it works, and the panic is useful only to the people running the next scam. Money moves out of an Indian bank account with a credential: an OTP, a UPI PIN, a card number and CVV, or a password. None of those appear in what SBI’s filing describes.

The opposite misconception is just as wrong: “nothing important leaked, so I can relax.” Read the list again: name, date of birth, home address, branch, internal customer ID, the loan you once enquired about. That is the information a real bank officer would know about you.

What actually happened, in order

• 16 October: a group calling itself “Siriusim” claimed on a cybercrime forum to hold around 375,000 SBI-linked records and 2,722 PDF documents, including loan applications and account-opening forms. SBI was alerted the same day by its threat-intelligence provider, CERT-In and the Defence Cyber Agency.
• A spot check: the Free Press Journal examined four sample records. The phone numbers were real, and one person’s WhatsApp photo matched the KYC photograph in the dump. Four records prove nothing about the rest, but they aren’t nothing either.
• 21 October: SBI filed with the exchanges. Its preliminary review found 3,897 records with personal information. It hired an independent CERT-In-empanelled auditor. The source is unknown: SBI itself, a subsidiary, or a third-party vendor that handles applications.

The twist: “no material impact” — on whom?

The filing says the incident has no material impact on the bank’s operations, finances or business continuity. That’s probably true, and it describes the bank’s business. It says nothing about the customers whose details are on the list, or about whether they will be told. If you’re waiting for a message from your bank confirming you’re affected, you may wait a long time.

So think of the leak as a costume, not a key. The data lets the fraudster play the part of your bank. The one thing they still need is the six digits only you have.

What to actually do

1. Treat “they know my details” as zero proof. No bank asks for an OTP, UPI PIN or CVV over a call or message, however much the caller knows about you.
2. Hang up and call back yourself on the number printed on your card or shown in the official YONO app. Never use a number the caller gives you.
3. Report the fake call on Sanchar Saathi’s Chakshu facility, and forward phishing to report.phishing@sbi.co.in.
4. If money goes, move fast. Call 1930 and file at cybercrime.gov.in, then tell your bank in writing. Under RBI’s 2017 rules, a fraud caused by a breach elsewhere in the system and reported within three working days means zero liability for you.

One more thing: ignore any link promising to “check if your SBI data leaked”. After every leak, a second scam follows, and it usually starts with a link like that.