A hacker group says it has 3.75 lakh records from State Bank of India customers, including KYC and loan forms. The SBI data breach is still only a claim, and SBI hadn’t confirmed it when the news broke. You don’t need to panic, but you should spend 15 minutes on eight steps today.
The real risk isn’t someone emptying your account from a spreadsheet. It’s a very convincing phone call that uses your own details, and section 3 shows you how to spot it.
⚡ Key takeaways
- A group calling itself “Siriusim” posted the claim on BreachForums: about 3.75 lakh data rows and 2,722 PDF files, said to include KYC records, loan applications and account-opening forms.
- Nobody has independently confirmed where the data came from. SBI had not responded to reporters as of 20 October.
- Biggest risk: scam calls that quote your name, branch and loan details. SBI will never ask for your OTP, PIN or CVV.
- Lock what you don’t use: switch off international and online card use in YONO or net banking. RBI says every bank must offer this 24×7.
- If money goes, report within 3 working days. RBI’s rules give you zero liability for a third-party breach reported that fast.
What the SBI Data Breach Claim Actually Says
The claim first surfaced on 16 October 2026, when the cybersecurity account CyberPulse56 flagged a post on BreachForums, a forum where stolen data is traded. According to Free Press Journal, the seller calls itself “Siriusim” and says it holds 375,000 rows of data in CSV files plus 2,722 PDF documents.
The listed data is the worrying part. It reportedly includes loan applications, account-opening forms, residential addresses and KYC records. The four free sample records showed names, dates of birth, mobile numbers, email IDs, nominees, branch details, IFSC codes and CKYC numbers. FPJ checked the samples and found the phone numbers were real, and one WhatsApp photo matched the passport photo in the KYC document.
What we still don’t know
- Where it came from. It could be SBI, one of its subsidiaries or a third-party agency that handles loan paperwork. Reports don’t say.
- How old it is. The records could be recent or from an older incident.
- How many people. 3.75 lakh rows doesn’t mean 3.75 lakh customers, because one person can appear in several rows.
The420.in also treated it as an unverified allegation and said SBI hadn’t replied to its request for comment. So treat it like this: probably some real data, unknown size, unknown source. That’s enough reason to tighten things up.
Can Hackers Empty Your Account With This Data?
Honestly, not directly. A name, address and CKYC number don’t let anyone log in to YONO or withdraw cash. They still need your password, OTP, UPI PIN or card details, and none of those appear in the reported samples.
The danger is what this kind of data makes possible:
- Targeted phishing. A caller who knows your loan amount and branch sounds a lot more believable.
- Fake loan applications in your name, using your KYC documents.
- SIM-swap attempts, where someone uses your details to get a duplicate SIM and receive your OTPs.
- Identity theft, which FPJ’s report also listed among the risks if the data is genuine.
So the job isn’t to change everything. It’s to make sure that even a well-informed scammer hits a wall.
💡 Pro tip
Breach news always brings fake “check if your data leaked” links on WhatsApp. Don’t click them. No bank or government site asks you to type your account number or Aadhaar into a link someone forwarded.
Steps 1 to 3: Beat the “SBI Officer” Call Before It Comes
This is where most people actually lose money, so start here.
Step 1: Learn the 1600 rule
Banks and other RBI-regulated companies now make service and transaction calls from numbers starting with 1600, under TRAI’s direction. We covered the details in our phone safety guide for parents. A “bank officer” calling from an ordinary 10-digit mobile number is a red flag, however much they know about you.
Step 2: Never share an OTP, PIN or CVV
Not to “stop a fraud”, not to “update KYC”, not to “close the loan”. Real SBI staff don’t need them. If the caller sounds rushed or angry, that’s the script working. Hang up.
Step 3: Call back on the real number
Hang up and dial the number printed on your card, or the ones on SBI’s official contact page. Notice the address: SBI’s site now lives at sbi.bank.in, and the old sbi.co.in address redirects there. A link that looks like “sbi-kyc-update.in” isn’t SBI.
| What the caller says | What it really is | What to do |
|---|---|---|
| “Your KYC will expire tonight” | Phishing | Hang up, update KYC only at a branch or in YONO |
| “A loan was taken in your name, share OTP to cancel” | Fake loan scare | Hang up, call SBI’s official line |
| “We’re from cyber cell, your account is in a case” | Impersonation | Real police don’t ask for money or OTPs on the phone |
| “Install this app so we can help” | Screen-sharing trap | Never install AnyDesk or similar on a caller’s request |
Steps 4 and 5: Lock the Doors You Don’t Use
Step 4: Switch off card features you don’t need
RBI’s card security circular from January 2020 makes every bank offer a way to switch card transactions on or off and set limits. That covers domestic and international use, ATM, PoS, online and contactless payments, around the clock through the app, net banking, ATMs or IVR.
In YONO or OnlineSBI, look for the debit card’s usage or limit settings. If you’ve never used your card abroad, turn international use off. Set a sensible online limit. It takes two minutes, and a stolen card number becomes far less useful.
Step 5: Lock your Aadhaar biometrics
Because KYC records are part of the claim, it makes sense to lock your Aadhaar biometrics too. That blocks fingerprint withdrawals through AePS by anyone who has a copy of your Aadhaar details. Our step-by-step guide to the Aadhaar biometric lock walks you through it on the mAadhaar app or the UIDAI site.
⚠️ Watch out
If your SIM suddenly stops working with “no network” for hours, call your telecom operator right away. A sudden SIM failure after a data leak can mean someone has requested a duplicate SIM in your name.
Steps 6 and 7: Watch for Loans You Never Took
This is the part of the SBI data breach claim people overlook. Loan applications with income details are exactly what a fraudster needs to apply for credit in your name.
Step 6: Pull your free credit report
RBI directed India’s four credit bureaus (CIBIL, Experian, Equifax and CRIF High Mark) to give individuals one free full credit report every calendar year, including the score. CRIF High Mark explains the rule on its own site. That’s up to four free reports a year, one from each.
Check the “accounts” and “enquiries” sections. Any loan or credit card you don’t recognise, or a hard enquiry from a lender you never approached, needs a dispute with the bureau and a complaint to that lender.
Step 7: Read every SMS from your bank for a month
Boring, but it works. Fraud usually starts small: a ₹1 test debit, a new payee added, a “loan application received” SMS. If you see one, don’t reply to the SMS. Call the bank yourself.
Also readFake Discount or Real Deal? Check Any Sale Price in 2 Minutes Step 8: If Money Goes, the 3-Day Rule Protects You
Speed decides how much you get back. RBI’s customer liability circular sets clear rules for unauthorised electronic transactions.
| When you report a third-party fraud | Your liability |
|---|---|
| Within 3 working days | Zero |
| 4 to 7 working days | Up to ₹10,000 for most savings accounts (₹5,000 for basic BSBD accounts), or the transaction amount if lower |
| After 7 working days | As per the bank’s board-approved policy |
After you report, the bank has to credit the disputed amount to your account within 10 working days (a “shadow credit”), and it must resolve the complaint within 90 days.
Who to call, in this order
- SBI’s unauthorised transaction line: 1800 11 1109 (toll-free) or 94491 12211, as listed on SBI’s contact page. Ask them to block the card or channel.
- 1930, the national cyber fraud helpline, or file a complaint at cybercrime.gov.in. Call within the first hour if you can.
- Chakshu on Sanchar Saathi for suspicious calls or SMS that didn’t cost you money yet.
Write down the complaint number every time. You’ll need it if you escalate to the RBI Ombudsman later.
✅ Our verdict
Don’t close your SBI account over an unconfirmed claim. Do three things today: switch off international and unused card features, lock your Aadhaar biometrics and save 1930 in your phone. Then treat every “bank” call for the next few months as fake until you’ve called back yourself.
Frequently Asked Questions
Has SBI confirmed the data breach?
No. As of 20 October 2026, news reports said SBI had not responded to the claim or confirmed any breach. The data’s origin is also unverified; it could come from SBI, a subsidiary or a third-party agency.
What data was leaked in the SBI data breach claim?
The hacker group claims about 3.75 lakh data rows and 2,722 PDFs, said to include KYC records, loan applications and account-opening forms. Sample records showed names, birth dates, phone numbers, addresses, nominees, branch and CKYC details. No passwords or PINs were reported.
Should I change my YONO password?
It doesn’t hurt, and it takes a minute. Passwords weren’t reported in the samples, so the more useful steps are switching off unused card features and refusing to share OTPs on calls.
Will I get my money back if I’m defrauded?
Under RBI rules, if the fraud came from a third-party breach and you report it within 3 working days, your liability is zero. The bank must credit the amount within 10 working days of your report while it investigates.
How do I know a call is really from SBI?
Bank service calls now come from the 1600 number series under TRAI’s direction. Even then, never share an OTP or PIN. If in doubt, hang up and call the number on the back of your card.
The Bottom Line
The SBI data breach claim isn’t confirmed, but the sample data looked real enough to act on. You can’t un-leak a KYC form. What you can do is make that data useless: lock card features, lock Aadhaar biometrics, check your credit report and never trust a caller just because they know your branch. Next, take 20 minutes to run through our smartphone privacy settings so your phone isn’t the weak link.
Keep reading
Read nextPhone Safety for Parents: 9 Settings to Fix on Your Diwali Visit
Read next15 Smartphone Privacy Settings You Probably Never ChangedRead nextDiwali Sale Scams: 7 Fake Offers to Spot Before You PaySources
- Free Press Journal: SBI customer data allegedly on dark web (17 Oct 2026)
- The420.in: hacker group claims SBI data breach (20 Oct 2026)
- Timeline Daily: SBI has not confirmed the claim
- SBI: official customer care and fraud reporting numbers
- RBI: limiting customer liability in unauthorised electronic transactions (2017)
- RBI: enhancing security of card transactions (2020)
- CRIF High Mark: one free credit report a year