Quick Summary
- 1.SBI found 3,897 customer records with personal details in a set of about 3.75 lakh records found online
- 2.Names, mobile numbers, dates of birth, email and home addresses were among the details
- 3.SBI says balances and funds are safe; passwords, card numbers and OTPs aren't among the listed details
- 4.The main risk is fake calls and messages that use your real details, so never share an OTP, PIN or password
What Happened
State Bank of India told the stock exchanges on October 21, 2026 that it had "experienced an incident involving the loss of certain data". According to the filing and news reports:
- October 16: SBI was alerted by CERT-In and the Defence Cyber Agency that a data set linked to the bank had appeared online
- SBI reviewed about 3.75 lakh (375,000) records and identified 3,897 customer records containing personal details
- SBI started its incident response process and brought in an independent CERT-In-empanelled firm to investigate
- SBI said the incident has no material impact on its operations or finances
- October 23: SBI said it had informed the affected customers individually and that their balances and funds are safe
The source of the data hasn't been confirmed yet. SBI said its investigation will check whether the data is genuine, where it came from and how far it goes. We'll update this page when SBI shares more.
What Was Exposed
SBI's filing listed these details in the records it identified:
- Names and gender
- Registered mobile numbers
- Dates of birth
- Email addresses
- Residential addresses
- Branch and CIF (customer information file) identifiers, and lead IDs
- Information linked to loan and lead records
The filing didn't list account numbers, balances, net banking passwords, card details, OTPs, PAN or Aadhaar. That's reassuring, but the details above are still enough for someone to pretend to be the bank convincingly.
The Real Risk: Fake Calls and Messages
With your name, mobile number, date of birth, address and branch, a caller can sound exactly like your bank. The details make the approach believable; the goal is to get something they don't have yet, such as an OTP, PIN or card number. Common approaches:
- A call or WhatsApp message saying your KYC has expired and your account will be frozen
- An SMS with a link to "verify" or "secure" your account after the leak
- A pre-approved loan offer that needs a "processing fee" or your OTP
- A request to install a screen-sharing or remote support app
- A caller who reads out your details to prove they're from SBI
Knowing your details doesn't make someone your bank. SBI says it never asks for your OTP, PIN or password.
What to Do Now
- Never share an OTP, PIN, password, CVV or card number, whoever asks
- Don't click links in SMS, email or WhatsApp messages about the leak; type sbi.co.in yourself or use the YONO app
- If someone calls from "SBI", hang up and call the number on the back of your card or on SBI's website
- Don't install apps a caller asks you to install, especially screen-sharing apps
- Turn on SMS and email alerts for every transaction, and check your statement for anything you don't recognise
- Change your net banking password if you've used it anywhere else, and make your email password unique too
- Turn on two-step verification for your email account, since your email address was among the details
- Check your credit report for loan enquiries you didn't make
Need a strong, unique password? Our free password generator makes one in your browser and doesn't send it anywhere.
Where to Report Fraud
If you get a suspicious call or message, or notice a transaction you didn't make:
- Call the national cyber fraud helpline 1930 straight away; reporting quickly gives the best chance of stopping a transfer
- Report online at cybercrime.gov.in
- Forward phishing emails and messages to SBI at report.phishing@sbi.co.in
- Block your card or net banking through the YONO app or SBI's official customer care if you think your details were used
How to Know If You're Affected
SBI says it contacted affected customers individually by email and/or WhatsApp. If you get such a message, treat it carefully: read it, but don't click links or call numbers in it. Confirm through SBI's website, the YONO app or your branch.
Whether or not you were in this data set, your email address may have appeared in other leaks over the years. You can check it for free at Have I Been Pwned. Our data leak tracker lists other recent leaks and what to do after any of them.
Where a VPN Fits (and Where It Doesn't)
To be clear: a VPN can't stop a leak like this. The data was held by the bank or a party it works with, not taken from your phone, and nothing on your device can undo it.
What a VPN does is encrypt your own connection. On public Wi-Fi in a café, station or hotel, it stops the network from seeing which sites and apps you use, and your internet provider sees only an encrypted connection. Banking apps already encrypt their own traffic, so the VPN adds privacy for everything else you do. If that's useful to you, here's how a VPN works.
Sources
This page is based on SBI's stock-exchange filing and these reports:
SBI Data Leak: Common Questions
Short answers about the October 2026 SBI data leak.
Keep your own connection private.
SafePassVPN encrypts your phone's connection on public Wi-Fi and mobile data, so the network you're on can't see what you do online.