# SBI confirms cyberattack, 3,897 customer records found on dark web 2026-10-21T07:30:05+00:00 | Governance | Indian Opinion Desk Corroboration: 6 independent outlets State Bank of India has confirmed a cyberattack after 3,897 customer records containing personally identifiable information were found on the dark web. SBI said on Wednesday (21 October) that it received alerts on 16 October from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In about suspected data exposure. A preliminary analysis of approximately 3.75 lakh records available on the dark web identified the compromised data, which included customers' names, mobile numbers, dates of birth, email addresses, residential addresses, branch and CIF identifiers along with loan-related records. SBI said it activated its cyber incident response protocols and engaged an independent CERT-In-empanelled cybersecurity agency for a comprehensive assessment. The bank stated the incident had no material impact on its core business operations, financial performance or business continuity. The bank said a detailed investigation was underway to establish the authenticity and source of the exposure. An anonymous hacker group called Siriusim had earlier claimed possession of the data, though SBI has not named the group. ## Indian Opinion Analysis All six outlets report the same core facts from SBI's exchange filing: 3,897 customer records containing PII were found among about 3.75 lakh records on the dark web after alerts on 16 October from the Defence Cyber Agency and CERT-In. Every source attributes the reassurance that operations are unaffected to the bank's own statement, and none adds independent verification or criticism. The Hindu Business Line and CNBC-TV18 reproduce the filing verbatim with minimal commentary, while Times Now and India Today add context about the Siriusim group's earlier claim and India Today notes it first reported the possible breach on 19 October. The coverage is uniform straight reporting with no discernible editorial slant across any outlet. The next step remains SBI's ongoing investigation, with the bank saying appropriate remedial measures are being implemented. ## Coverage Coverage: 6 sources, 6 neutral - thefederal.com (neutral report) Straight recounting of filing, no added commentary or criticism - livemint.com (neutral report) Includes customer advice from expert, neutral on the incident itself - timesnownews.com (neutral report) Adds analysts' concern but no independent reporting - thehindubusinessline.com (neutral report) Verbatim filing text, no editorial framing - cnbctv18.com (neutral report) Verbatim filing text, no editorial framing - indiatoday.in (neutral report) Adds India Today's earlier reporting on group Siriusim This brief was synthesised by AI from the 6 sources linked above, so one read covers every framing they carry. Update, 21 October 2026: this story now draws on 6 sources. Last updated 2026-10-21T08:29:49+00:00. Tags: CERT-In, Defence Cyber Agency, SEBI, Siriusim, State Bank of India Canonical: https://indianopinion.org/sbi-says-3897-customer-records-exposed-on-dark-web/ License: Summary and commentary (c) Indian Opinion, reusable with attribution. Facts belong to the linked sources. Cite: https://indianopinion.org/sbi-says-3897-customer-records-exposed-on-dark-web/#story-in-brief How this brief was made: an AI model read the reports linked above and wrote this summary and analysis, which were published automatically. Published briefs are sampled every hour by an automated quality check; the editor verifies its findings and approves corrections, and corrected briefs carry a dated correction line. Stance labels are editorial classifications of how each outlet framed this story, assigned by the same model, not ratings of the outlets. We do no original reporting. Methodology: https://indianopinion.org/ai-use-policy/