After the data breach at State Bank of India (SBI), Internet Freedom Foundation (IFF) said that SBI has not said that it has informed any of the affected customers, and its disclosure is silent on the point, in a statement today (October 21). Also, the organisation demanded five actions from SBI and authorities.
Five days have passed between the alert and today’s filing. The filing assured investors that the incident has no material impact on the bank’s operations, financial performance, or business continuity, said IFF in a tweet. IFF is an Indian digital rights advocacy organisation.
However, SBI’s filing does not state anything to the 3,897 people whose phone numbers, dates of birth, and home addresses are now with fraudsters. These customers are the most likely to receive calls from persons posing as SBI officials who can recite their account details back to them. A customer cannot guard against a fraud she has not been warned of, as IFF showed concern about the data breach.
IFF sought five demands from SBI
- Notify every affected customer by SMS, email and letter in English, Hindi and the local language, explaining what data was exposed and what to do. SBI should also set up a helpline and an online checker.
- Disclose the scale and contents: what the 3.75 lakh records and 2,722 documents contain, how many customers are affected, and whether KYC documents (Aadhaar, PAN, passport) are included.
- Explain how the data leaked once the probe ends, including any vendor or direct selling agent link, and publish a summary of the investigating agency’s findings.
- RBI should set a fixed deadline for all regulated entities to notify customers of data breaches until the DPDP Act comes into force.
- MeitY should immediately enforce Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, the breach-notification provisions.
Data breach at SBI
India’s largest lender said it experienced an incident involving the loss of certain data. It promptly activated its cyber incident response and containment protocols, and preliminary analysis shows 3.75 lakh records available on the dark web. The customer records of 3,897 containing PII were identified. PII Is Personally identifiable information.
The bank said that it does not have any material impact on the bank’s core business operations.
“We hereby inform you that the Bank has experienced an incident involving the loss of certain data. On 16 October 2026, the Bank received communications from its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In regarding an alert concerning the suspected exposure of the Bank’s customer data on the dark web,” said the company in an exchange filing.
Sparsh Bansal is the Chief Copy Editor with ET Now Digital. He writes extensively on equity markets, IPO, with a passion for financial markets and a sharp eye to detect patterns, I extensively cover IPOs, stock movements, and investment strategies that shape India’s economic landscape.
He tracks IPO debuts, corporate earnings, and regulatory changes, bringing clarity to complex financial data, which bridges the gap between numbers and hidden patterns behind them.
Over the years, he has authored more than 2000 articles that have ranked prominently on Google, demonstrating commitment to high-quality journalism and impactful reporting.
Before ET Now Digital, Sparsh worked as a Correspondent with Financial Express. He started his career with Informist Media as a Reporter. He holds a Post Graduate Diploma in Business and Finance Journalism from Asian College Journalism – Bloomberg, and a Bachelor’s degree in Journalism and Mass Communication from the Noida International University.