# SBI Identifies 3,897 Customer Records in Dark Web Review.

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/40407
Published: 2026-10-25T04:34:47.000Z
Updated: 2026-10-25T04:34:47.000Z
Section: Technology

> SBI says its review flagged 3,897 records among roughly 375,000 found on the dark web; the count does not establish how many people were affected.

State Bank of India’s disclosure of 3,897 customer records found among data available on the dark web leaves the source of the suspected exposure unknown and blockchain’s possible role unproven.

The bank’s preliminary review examined a data set of about 375,000 records and flagged 3,897 records containing personal information as connected to SBI customers. The count refers to records, not a verified tally of distinct people, and the review did not establish that the entire data set belonged to SBI customers. SBI said the records’ authenticity, completeness, origin and scope remain under investigation.

The identified information included names, gender, birth dates, registered mobile numbers, email and residential addresses, branch and CIF identifiers, lead IDs, and metadata related to loan and lead records. Three parties alerted the bank on Oct. 16: its threat intelligence provider, the Defence Cyber Agency and CERT-In.

SBI activated response and containment measures and engaged an independent cybersecurity agency empanelled by CERT-In. The bank said its core functions continued without disruption and the incident had no material effect on operations, financial performance or business continuity.

On Oct. 23, SBI said it had individually notified customers whose information it identified by email or WhatsApp, and that their account balances and funds were safe. It did not disclose how many people it contacted.

A tamper-evident blockchain ledger could help preserve access logs by making later changes to those records detectable. That could protect the integrity of an audit trail, but it would not by itself secure personal information stored in a bank’s or service provider’s systems. The investigation has not identified where the SBI records came from, so the available facts do not establish whether a ledger would have prevented them from appearing online.

The Reserve Bank of India’s digital rupee pilot tests central bank digital currency technology, architecture and use cases, with SBI among its participating retail banks. Its retail wallets are for payments; the pilot is not described as a system for storing customer identity records.

India’s Digital Personal Data Protection Rules, 2025 specify safeguards including encryption or masking, access controls, logs and security measures for data processors. Rules on safeguards and breach notifications are scheduled to take effect May 13, 2027. They call for affected individuals to be notified without delay and detailed information to reach the Data Protection Board within 72 hours of the data fiduciary becoming aware of a breach, unless the Board allows a longer period.