# SBI finds 3,897 customer records on the dark web; DPDP breach duties start only in 2027 URL: https://upsc.help/current-affairs/2026-10-22/sbi-dark-web-leak-dpdp-gap/ Date: 22 October 2026 (2026-10-22) Source: The Hindu, Page 1 UPSC papers: GS3, GS2 Publisher: upsc.help (Pratidin), free and open-source UPSC Civil Services current affairs. Not affiliated with UPSC. Every fact was checked against the source reports by a separate review before publishing. **In one line:** SBI disclosed that 3,897 customer records with personal data surfaced in a dark-web leak, at a time when the DPDP Act's duty to inform affected people has not yet come into force. The State Bank of India (SBI) told the stock exchanges on 21 October 2026 that it had identified 3,897 customer records containing personally identifiable information in data allegedly leaked on the dark web. SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). A preliminary review of about 3.75 lakh records found the 3,897 with personal data, including names, dates of birth, gender, residential addresses, registered mobile numbers, email addresses, customer information file (CIF) numbers, lead IDs and metadata linked to loans. SBI said it activated its cyber incident response and containment measures, engaged an independent cybersecurity agency empanelled by CERT-In, and was examining the data's authenticity, source and extent. It said the incident had no material impact on its core business operations, financial performance or business continuity. A group calling itself 'Siriusim' reportedly claimed about 3.8 lakh CSV records and 2,722 PDF documents linked to SBI; the authenticity and source of that data remain unverified. The disclosure was made under SEBI's Listing Obligations and Disclosure Requirements Regulations, 2015. The episode exposes a gap in India's data protection law. The Digital Personal Data Protection (DPDP) Act, 2023 requires a data fiduciary to intimate a personal data breach to the Data Protection Board and to each affected person, and the DPDP Rules require a detailed report to the Board within 72 hours. Penalties can reach ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for failing to notify. But the Rules, notified in November 2025, phase in the core duties over 18 months, to 13 May 2027. Until then, CERT-In's 2022 directions (reporting within six hours) and Section 43A of the IT Act, 2000 apply, and the DPDP duty to tell affected customers is not yet in force. ## Prelims facts - SBI disclosed on 21 October 2026 that 3,897 customer records with personal data were found among about 3.75 lakh records leaked on the dark web. - The alerts came on 16 October 2026 from SBI's threat intelligence provider, the Defence Cyber Agency and CERT-In. - Under the DPDP Act, 2023 a data fiduciary must intimate a breach to the Data Protection Board and each affected person; the Rules require a detailed Board report within 72 hours. - The DPDP Act's core duties apply only from 13 May 2027, 18 months after the Rules were notified in November 2025. - CERT-In's directions of 28 April 2022 require cyber incidents to be reported within six hours. ## Quick recall - **How many SBI customer records with personal data were found in the leak?** 3,897, out of about 3.75 lakh records reviewed. - **Which three sources alerted SBI on 16 October 2026?** Its threat intelligence provider, the Defence Cyber Agency and CERT-In. - **When was the DPDP Act enacted?** 11 August 2023. - **When do the DPDP Act's core duties apply?** From 13 May 2027, 18 months after the Rules were notified. - **Deadline for a detailed breach report to the Data Protection Board?** Within 72 hours of becoming aware, under the DPDP Rules. - **Maximum penalty for failing to take reasonable security safeguards?** ₹250 crore. - **Members of the Data Protection Board of India?** Four; appeals go to TDSAT. - **CERT-In's cyber incident reporting deadline?** Six hours, under directions of 28 April 2022 (Section 70B(6), IT Act). ## Prelims practice question Under the Digital Personal Data Protection framework, a data fiduciary that suffers a personal data breach must intimate it to whom? (a) Only CERT-In (b) Only the Reserve Bank of India (c) The Data Protection Board of India and each affected data principal (d) Only the stock exchanges, if it is a listed company Answer: (c) The Data Protection Board of India and each affected data principal. The DPDP Act, 2023 and the DPDP Rules require intimation to the Data Protection Board (with a detailed report within 72 hours) and to each affected data principal without delay. CERT-In reporting and stock exchange disclosure arise under other rules. ## UPSC previous-year questions this connects to - UPSC Mains 2024, GS3: Describe the context and salient features of the Digital Personal Data Protection Act, 2023. (https://upsc.help/pyq/q216-describe-context-salient-features-digital-personal-data/) How to use this story in the answer: Open with the SBI leak to set the context, then use its gap to explain the Act's breach-notification and penalty features. - UPSC Mains 2022, GS3: What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy. (https://upsc.help/pyq/q343-different-elements-cyber-security-keeping-view-challenges/) How to use this story in the answer: Use the SBI leak to show how India's incident detection and reporting works, and where it still falls short. - UPSC Prelims 2024, Prelims: Under which of the following Articles of the Constitution of India, has the Supreme Court of India placed the Right to Privacy? (a) Article 15 (b) Article 16 (c) Article 19 (d) Article 21 (https://upsc.help/pyq/q129-under-following-articles-constitution-india-has-supreme/) ## Mains practice question A data breach at a major public sector bank has revealed gaps in India's personal data protection regime. Discuss the safeguards available today and how the Digital Personal Data Protection Act, 2023 will change them. (150 words) ### Model answer On 21 October 2026, SBI disclosed that 3,897 customer records with personal data were found in a dark-web leak, after alerts on 16 October. ## Safeguards today - **CERT-In directions (2022):** incidents must be reported within six hours. - **Market disclosure:** SBI disclosed under SEBI's LODR Regulations, 2015, informing investors rather than customers. - **Section 43A, IT Act:** compensation for negligent handling of sensitive data. ## What the DPDP Act adds - **Duty to notify:** intimate the Data Protection Board and each affected person; detailed Board report within 72 hours. - **Penalties:** up to ₹250 crore for weak safeguards, ₹200 crore for failure to notify. - **Rights:** access, correction and erasure for individuals. ## The gap - Core duties start only on 13 May 2027, so the DPDP duty to tell affected customers is not yet in force. Faster rollout of breach-notification duties for large data holders like banks would close this gap. ## The basics ## Why this matters On 21 October 2026, the State Bank of India (SBI), the country's largest bank, told the stock exchanges that personal details of 3,897 customers had been found in data leaked on the dark web. The case is a live test of India's data protection framework. The law that would require SBI to tell every affected customer, the Digital Personal Data Protection Act, 2023, has been passed, but its main duties start only in May 2027. ## Who raised the alarm SBI said it received alerts on 16 October 2026 from three sources: its own threat intelligence service provider, the Defence Cyber Agency and CERT-In. It then activated its incident response, engaged an independent cybersecurity firm empanelled by CERT-In and disclosed the incident under SEBI's listing regulations. ## What the DPDP Act will add The Digital Personal Data Protection Act, 2023 treats a bank as a data fiduciary, the entity that decides why and how personal data is processed. Once its core provisions apply, a fiduciary must report a Personal data breach to the Data Protection Board of India and to every affected person. ## Phased start The gap matters. Until May 2027, the DPDP Act does not require a bank to tell customers whose data has leaked. ## Sources - https://www.tribuneindia.com/news/india/3897-customer-details-found-on-dark-web-sbi-flags-data-breach/ - https://www.outlookmoney.com/personal-finance/sbi-confirms-cyberattack-3897-customer-records-stolen-leaked-on-dark-web - https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf - https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Digital%20Personal%20%20Data%20Protection%20Rules%20-%2015%20November%202025.pdf - https://trilegal.com/knowledge-repository/2022-cert-in-directions-on-reporting-cyber-incidents/