State Bank of India disclosed in a filing on 21 October 2026 that about 3.75 lakh records were found on the dark web, of which 3,897 customer records contained personal details such as names, mobile numbers, email addresses, dates of birth, residential addresses and loan-lead information. SBI said it was alerted by a threat-intelligence provider, the Defence Cyber Agency and CERT-In, activated its incident response, engaged a CERT-In-empanelled agency and is still investigating the source. Because the DPDP Act's breach-reporting and security duties apply only from 13 May 2027, affected customers currently have no remedy under that Act. From that date, a breach like this must be reported to every affected person and to the Data Protection Board, with a detailed report within 72 hours.
| Who is affected | Any business that holds customer, lead or loan data, especially where vendors or partners also hold copies. SBI customers should watch for phishing calls and messages that use their details. |
|---|---|
| What to do | Use the time before May 2027 to map where customer data sits (including with vendors), restrict and log access, and write a breach plan that can produce the 72-hour report to the Data Protection Board. CERT-In's 6-hour reporting already applies to cyber incidents today. |
| Source | Business Today |
This is a plain-language summary for general information, not legal or tax advice. The court order or official document is the authoritative text. Ask an expert how it applies to you.