देश के सबसे बड़े सरकारी बैंक SBI के ग्राहकों से जुड़ी एक बड़ी खबर सामने आ रही है। State Bank of India ने 3,897 ग्राहकों की निजी जानकारी को डार्क वेब पर मिलने की आशंका जताई है। इस जानकारी में SBI ग्राहकों के नाम, मोबाइल नंबर, डेट ऑफ बर्थ से लेकर उनके ईमेल और लोन से जुड़ी जानकारी शामिल है। बैंक ने स्टॉक एक्सचेंज को दी जानकारी में इस साइबर घटना का खुलासा किया है। हालांकि, SBI का कहना है कि उसकी कोर बैंकिंग सेवाएं सामान्य रूप से चल रही हैं, इनपर किसी भी तरह का कोई असर नहीं हुआ है।
SBI के अनुसार, 16 अक्टूबर को बैंक को Threat Intelligence Service Provider, Defence Cyber Agency और Indian Computer Emergency Response Team यानी CERT-In से ग्राहक डेटा के संभावित लीक होने का अलर्ट मिला था। इसके बाद बैंक ने डार्क वेब पर मिले करीब 3,75,000 रिकॉर्ड की शुरुआती जांच की और इसमें 3,897 ऐसे ग्राहक रिकॉर्ड की पहचान हुई, जिनमें निजी जानकारी मौजूद होने की आशंका है।
Statement : SBI has told the stock exchanges about its data breach, but not the customers whose data was leaked New Delhi, 21 October 2026 Today, the State Bank of India told the BSE and the National Stock Exchange, in a disclosure under Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, that it has experienced an incident involving the loss of customer data. On 16 October 2026 the bank received alerts from its threat intelligence service provider, the Defence Cyber Agency and CERT-In that its customers’ data was available on the dark web. Its preliminary analysis of about 3.75 lakh records found 3,897 customer records containing personal information. These include registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and details linked to loan records. The bank says it does not yet know where the data came from, and it has engaged a CERT-In empanelled agency to find out. SBI did not detect this breach itself and learnt of it from outside agencies after the data had already been published. On the same day, a threat monitoring account on X flagged a claim by a group calling itself “Siriusim” that it had released 3.75 lakh rows of SBI data and 2,722 PDF documents, including loan applications and account opening forms. The bank’s disclosure does not mention these documents. It also does not say what the remaining records, beyond the 3,897 it has identified, contain. At the time of this statement, SBI has not said that it has informed any of the affected customers, and its disclosure is silent on the point. Five days passed between the alert and today’s filing. The filing assures investors that the incident has no material impact on the bank’s operations, financial performance or business continuity. However, it does not state anything to the 3,897 people whose phone numbers, dates of birth and home addresses are now with fraudsters. These customers are the most likely to receive calls from persons posing as SBI officials who can recite their account details back to them. A customer cannot guard against a fraud she has not been warned of. The Internet Freedom Foundation calls on SBI to inform every affected customer directly and without further delay. We regret to note that the law in force today does not compel the bank to do so. Section 8(6) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to intimate a personal data breach to the Data Protection Board and to each affected Data Principal, and Rule 7 of the DPDP Rules, 2025 prescribes how this is to be done. But the Union Government chose a staggered commencement, and these provisions will take effect only on 13 May 2027, nearly four years after Parliament enacted the law. The reporting obligations that apply today, under the CERT-In Directions of 28 April 2022 and the RBI’s cyber security framework for banks, are owed to regulators and not to customers. A listed bank is bound to keep the stock exchanges informed. No law in force clearly binds it to inform the people whose data it holds. Our demands 1. SBI must inform each affected customer by SMS, email and letter to the registered address, in English, Hindi and the language of the customer’s branch, stating what data was exposed and what steps they should take. It should open a dedicated helpline and an online facility for customers to check whether their data is affected. 2. SBI must state what the 3.75 lakh records and the 2,722 documents contain, how many customers they relate to, and whether they include KYC documents such as Aadhaar, PAN or passport copies. 3. When the investigation concludes, SBI must disclose how the data left its systems, including whether it came through a vendor or a direct selling agent, and publish a summary of the investigating agency’s findings. 4. The Reserve Bank of India should direct all regulated entities to notify customers of personal data breaches within a fixed period, pending the commencement of the DPDP Act. 5. The Ministry of Electronics and Information Technology should bring Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules into force immediately.
— Internet Freedom Foundation (IFF) (@internetfreedom) October 21, 2026
इन रिकॉर्ड में ग्राहकों के नाम, रजिस्टर्ड मोबाइल नंबर, डेट ऑफ बर्थ, जेंडर, ईमेल और घर के पते जैसी जानकारी भी मौजूद है। इसके अलावा बैंक ब्रांच और Customer Information File से जुड़े पहचान नंबर, Lead IDs और लोन रिकॉर्ड से संबंधित डेटा आदि भी सामने आया है।
इस पूरे मामले पर SBI ने स्पष्ट किया है कि साइबर घटना का बैंक के प्रमुख कारोबार, वित्तीय लेनदेन और बैंकिंग सेवाओं की निरंतरता पर कोई महत्वपूर्ण असर नहीं पड़ा है। बैंक के अनुसार, घटना की जानकारी मिलते ही Cyber Incident Response और Containment Protocols एक्टिव कर दिए गए थे। फिलहाल इसकी जांच जारी है, जिससे यह पता लगाया जाएगा कि सामने आया डेटा कितना सही और पूरा है, यह कहां से आया और ग्राहकों के लिए कितना जोखिम पैदा कर सकता है।
यह भी पढ़ें: देसी कंपनी Lava ने इंडिया में लॉन्च किया डुअल डिस्प्ले वाला Aura Curve मोबाइल फोन..देखें क्या है कीमत