India’s banking sector faces renewed cybersecurity concerns after SBI identified 3,897 customer records containing personal information on the dark web. The bank disclosed the suspected data exposure on October 21, 2026, after reviewing approximately 375,000 records and receiving alerts from security agencies. SBI is investigating the source and extent of the exposure. Other incidents involving ICICI Bank, Bank of Baroda and banking technology providers also highlight wider industry risks.
SBI said it had experienced an 'incident involving the loss of certain data' and appointed an independent cybersecurity agency to investigate. The exposed information reportedly included customers’ names, phone numbers, birth dates, email addresses, residential addresses and metadata linked to loan records. SBI said the incident had not materially affected its core operations, financial performance or business continuity.
In July 2026, Bank of Baroda disclosed a cybersecurity incident involving a potential business email compromise. Reports linked the incident to an employee email account and claimed that more than 700GB of information appeared on the dark web. The bank launched a forensic investigation and said its core banking systems remained secure.
ICICI Bank faced a separate issue in April 2024, when a technical glitch mapped around 17,000 newly issued credit cards to incorrect users. Its iMobile Pay app exposed details that included card numbers and security codes. The bank blocked affected cards, arranged replacements and said it had received no reports of misuse.
In January 2025, the BASHE ransomware group also claimed it had breached ICICI Bank and threatened to release data. The bank did not publicly confirm that alleged breach, so the claim remains distinct from its confirmed card-mapping error.
Punjab National Bank faced disputed data exposure allegations in 2021, which the bank denied. In 2018, reports also linked around 10,000 PNB card records to an online sale, although the bank disputed the claim.
A ransomware attack on technology provider C-Edge disrupted payment services at nearly 300 cooperative and regional rural banks in 2024. NPCI isolated the provider from its payment network as a precaution, and affected banks restored services by August 1.
These incidents show how risks can emerge through customer databases, employee accounts and third-party providers. Banks continue to investigate individual cases, while customers should monitor transactions and avoid sharing passwords, OTPs or card security codes.
Also Read: Fairfax-IDBI Bank Deal: Digit Insurance, IIFL Assets in Focus