SBI finds 3,897 customer records on the dark web; DPDP breach duties start only in 2027
In one line: SBI disclosed that 3,897 customer records with personal data surfaced in a dark-web leak, at a time when the DPDP Act's duty to inform affected people has not yet come into force.
Published 22 October 2026. Written by Pratidin from the reports linked at the end; every fact checked by a separate review before publishing. How we work
The State Bank of India (SBI) told the stock exchanges on 21 October 2026 that it had identified 3,897 customer records containing personally identifiable information in data allegedly leaked on the dark web. SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). A preliminary review of about 3.75 lakh records found the 3,897 with personal data, including names, dates of birth, gender, residential addresses, registered mobile numbers, email addresses, customer information file (CIF) numbers, lead IDs and metadata linked to loans.
SBI said it activated its cyber incident response and containment measures, engaged an independent cybersecurity agency empanelled by CERT-In, and was examining the data's authenticity, source and extent. It said the incident had no material impact on its core business operations, financial performance or business continuity. A group calling itself 'Siriusim' reportedly claimed about 3.8 lakh CSV records and 2,722 PDF documents linked to SBI; the authenticity and source of that data remain unverified. The disclosure was made under SEBI's Listing Obligations and Disclosure Requirements Regulations, 2015.
The episode exposes a gap in India's data protection law. The Digital Personal Data Protection (DPDP) Act, 2023 requires a data fiduciary to intimate a personal data breach to the Data Protection Board and to each affected person, and the DPDP Rules require a detailed report to the Board within 72 hours. Penalties can reach ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for failing to notify. But the Rules, notified in November 2025, phase in the core duties over 18 months, to 13 May 2027. Until then, CERT-In's 2022 directions (reporting within six hours) and Section 43A of the IT Act, 2000 apply, and the DPDP duty to tell affected customers is not yet in force.
Prelims facts
- SBI disclosed on 21 October 2026 that 3,897 customer records with personal data were found among about 3.75 lakh records leaked on the dark web.
- The alerts came on 16 October 2026 from SBI's threat intelligence provider, the Defence Cyber Agency and CERT-In.
- Under the DPDP Act, 2023 a data fiduciary must intimate a breach to the Data Protection Board and each affected person; the Rules require a detailed Board report within 72 hours.
- The DPDP Act's core duties apply only from 13 May 2027, 18 months after the Rules were notified in November 2025.
- CERT-In's directions of 28 April 2022 require cyber incidents to be reported within six hours.
Quick recall
- How many SBI customer records with personal data were found in the leak?
- 3,897, out of about 3.75 lakh records reviewed.
- Which three sources alerted SBI on 16 October 2026?
- Its threat intelligence provider, the Defence Cyber Agency and CERT-In.
- When was the DPDP Act enacted?
- 11 August 2023.
- When do the DPDP Act's core duties apply?
- From 13 May 2027, 18 months after the Rules were notified.
- Deadline for a detailed breach report to the Data Protection Board?
- Within 72 hours of becoming aware, under the DPDP Rules.
- Maximum penalty for failing to take reasonable security safeguards?
- ₹250 crore.
- Members of the Data Protection Board of India?
- Four; appeals go to TDSAT.
- CERT-In's cyber incident reporting deadline?
- Six hours, under directions of 28 April 2022 (Section 70B(6), IT Act).
Prelims practice question
Under the Digital Personal Data Protection framework, a data fiduciary that suffers a personal data breach must intimate it to whom?
- Only CERT-In
- Only the Reserve Bank of India
- The Data Protection Board of India and each affected data principal
- Only the stock exchanges, if it is a listed company
Show answer
Answer: (c) The Data Protection Board of India and each affected data principal. The DPDP Act, 2023 and the DPDP Rules require intimation to the Data Protection Board (with a detailed report within 72 hours) and to each affected data principal without delay. CERT-In reporting and stock exchange disclosure arise under other rules.
Use this in UPSC Mains: previous-year questions
Recurring theme: Data protection and cyber security: the DPDP Act, breach reporting and institutions
Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
How to use thisOpen with the SBI leak to set the context, then use its gap to explain the Act's breach-notification and penalty features.
- SBI disclosed on 21 October 2026 that 3,897 customer records with personal data surfaced on the dark web.
- The Act requires breach intimation to the Data Protection Board and each affected person, with a detailed Board report within 72 hours under the Rules.
- Penalties reach ₹250 crore for weak security safeguards; core duties apply only from 13 May 2027.
- How to use this
Use the SBI leak to show how India's incident detection and reporting works, and where it still falls short.
- Alerts came from a private threat intelligence provider, the Defence Cyber Agency and CERT-In on 16 October 2026.
- CERT-In's 2022 directions require six-hour reporting, but a statutory duty to inform affected customers begins only in May 2027.
The right to privacy under Article 21 is the constitutional basis for data protection laws such as the DPDP Act.
Mains practice question
A data breach at a major public sector bank has revealed gaps in India's personal data protection regime. Discuss the safeguards available today and how the Digital Personal Data Protection Act, 2023 will change them. (150 words)
Model answer
On 21 October 2026, SBI disclosed that 3,897 customer records with personal data were found in a dark-web leak, after alerts on 16 October.
Safeguards today
- CERT-In directions (2022): incidents must be reported within six hours.
- Market disclosure: SBI disclosed under SEBI's LODR Regulations, 2015, informing investors rather than customers.
- Section 43A, IT Act: compensation for negligent handling of sensitive data.
What the DPDP Act adds
- Duty to notify: intimate the Data Protection Board and each affected person; detailed Board report within 72 hours.
- Penalties: up to ₹250 crore for weak safeguards, ₹200 crore for failure to notify.
- Rights: access, correction and erasure for individuals.
The gap
- Core duties start only on 13 May 2027, so the DPDP duty to tell affected customers is not yet in force.
Faster rollout of breach-notification duties for large data holders like banks would close this gap.
The basics
Why this matters
On 21 October 2026, the State Bank of India (SBI), the country's largest bank, told the stock exchanges that personal details of 3,897 customers had been found in data leaked on the dark web. The case is a live test of India's data protection framework. The law that would require SBI to tell every affected customer, the Digital Personal Data Protection Act, 2023, has been passed, but its main duties start only in May 2027.
Who raised the alarm
SBI said it received alerts on 16 October 2026 from three sources: its own threat intelligence service provider, the Defence Cyber Agency and CERT-In. It then activated its incident response, engaged an independent cybersecurity firm empanelled by CERT-In and disclosed the incident under SEBI's listing regulations.
- 1DetectionAlerts from a threat intelligence provider, the Defence Cyber Agency and CERT-In on 16 October 2026.
- 2Report to CERT-InCERT-In's 2022 directions require cyber incidents to be reported within six hours of being noticed.
- 3Containment and auditIncident response activated; a CERT-In-empanelled firm engaged.
- 4Disclosure to marketsListed companies disclose material events to stock exchanges; SBI filed on 21 October 2026.
What the DPDP Act will add
The Digital Personal Data Protection Act, 2023 treats a bank as a data fiduciary, the entity that decides why and how personal data is processed. Once its core provisions apply, a fiduciary must report a Personal data breach to the Data Protection Board of India and to every affected person.
- Report to CERT-In within six hours (2022 directions)
- Section 43A of the IT Act governs compensation for negligent data handling
- The DPDP duty to tell each affected person is not yet in force
- Intimate the Data Protection Board and each affected person
- Detailed report to the Board within 72 hours
- Penalties up to ₹250 crore for weak safeguards and ₹200 crore for failure to notify
Phased start
- 11 August 2023DPDP Act enacted
- November 2025Rules notified; Board-related provisions take effect at once
- 13 November 2026Consent manager provisions take effect
- 13 May 2027Core duties, including breach intimation, take effect
The gap matters. Until May 2027, the DPDP Act does not require a bank to tell customers whose data has leaked.
Go deeper
Why it matters for UPSC
Data protection is a GS2 and GS3 theme: the right to privacy, the DPDP Act, 2023 and cyber security institutions. UPSC asked about the DPDP Act's salient features in Mains 2024. This case shows how the law's phased rollout leaves a gap.
The core idea
Today, breach handling rests on the IT Act, 2000 and CERT-In directions, plus market disclosure rules for listed companies. The Digital Personal Data Protection Act, 2023 will add a legal duty to report every Personal data breach to the Data Protection Board of India and to each affected person, with heavy penalties. But its core duties start only on 13 May 2027.
Numbers and dates to remember
- 16 October 2026: SBI alerted; 21 October 2026: disclosure to stock exchanges.
- About 3.75 lakh records reviewed; 3,897 with personal data.
- CERT-In directions of 28 April 2022: report incidents within 6 hours.
- DPDP Act enacted 11 August 2023; Rules notified November 2025; core duties from 13 May 2027.
- Breach report to the Board: detailed report within 72 hours.
- Penalties: up to ₹250 crore (security safeguards), ₹200 crore (breach notification).
Where to go next
- Digital Personal Data Protection Act, 2023: the law, its principles and its phased start.
- Personal data breach: what counts as a breach and who must be told.
- Data Protection Board of India: the body that will enforce the Act.
- CERT-In: the national agency for cyber incident response.
Go deeper: does India's breach law protect customers yet?
What worked. Detection was multi-layered: a private threat intelligence provider, the Defence Cyber Agency and CERT-In all flagged the leak on 16 October 2026. SBI activated its incident response, hired a CERT-In-empanelled firm and disclosed the event to the markets within days, saying there was no material impact on its core operations.
What is missing. Market disclosure informs investors, not the people whose data leaked. The leaked fields reportedly included names, dates of birth, addresses, mobile numbers, email addresses and customer information file numbers: enough for targeted fraud. Under the Digital Personal Data Protection Act, 2023, a bank would have to intimate each affected person and the Data Protection Board of India. Those duties start only on 13 May 2027, 18 months after the Rules were notified. Until then, Section 43A of the IT Act and its rules continue to apply.
The other side. The government chose a phased rollout to give organisations time to change their systems; the consultation drew 6,915 inputs. Supporters of the timeline argue that rushed compliance would be weak compliance.
Unverified claims. A group calling itself 'Siriusim' claimed about 3.8 lakh CSV records and 2,722 PDF documents. Their authenticity and source were unverified. This shows why a mandatory Personal data breach report with facts on scope is valuable.
Digital Personal Data Protection Act, 2023
India's data protection law, its principles and its slow start.
In one line: The Digital Personal Data Protection (DPDP) Act, 2023 governs how organisations collect and use digital personal data, giving individuals (data principals) rights and placing duties on organisations (data fiduciaries).
Key features
Processing generally needs consent, or must fall under certain legitimate uses listed in the Act. Fiduciaries must keep data accurate, protect it with reasonable security safeguards, report breaches and erase data when its purpose ends. Individuals can seek access, correction and erasure; under the Rules, fiduciaries must respond to such requests within 90 days. Penalties go up to ₹250 crore.
Phased start
The Act was enacted on 11 August 2023 and the Rules were notified in November 2025. Board-related provisions took effect at once, consent manager provisions from 13 November 2026, and the core duties from 13 May 2027.
Where to go next
Personal data breach
What counts as a breach and who must be told, and when.
In one line: A personal data breach is any unauthorised processing, disclosure, loss of access to or alteration of personal data that compromises its confidentiality, integrity or availability.
What the DPDP framework requires
A data fiduciary must intimate a breach to the Data Protection Board and to each affected data principal. Under the DPDP Rules, an initial report goes to the Board without undue delay and a detailed report within 72 hours. Affected people must be told without delay, in plain language, what happened, the likely impact and the steps taken. Failure to notify can draw a penalty of up to ₹200 crore.
Why it is in the news
SBI's 3,897 affected customers cannot yet claim notification under the DPDP Act, because these duties start only on 13 May 2027.
Where to go next
Data Protection Board of India
The digital-by-design body that will enforce the DPDP Act.
In one line: The Data Protection Board of India is the body set up under the DPDP Act, 2023 to inquire into breaches of the law and impose penalties.
Structure and working
Under the Rules notified in November 2025, the Board has four members and works as a digital office: complaints can be filed and tracked online. Appeals against its orders lie with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). The provisions setting up the Board took effect immediately when the Rules were notified.
Why it is in the news
Breaches like SBI's would, from May 2027, have to be reported to the Board, which can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards.
Where to go next
CERT-In
The national agency that receives cyber incident reports today.
In one line: The Indian Computer Emergency Response Team (CERT-In) is the national agency for responding to cyber security incidents, functioning under the Ministry of Electronics and Information Technology.
Powers
Section 70B of the IT Act, 2000 designates CERT-In. On 28 April 2022 it issued directions under Section 70B(6) requiring cyber security incidents to be reported to it within six hours of being noticed or brought to notice. It also empanels independent auditors.
Why it is in the news
CERT-In was one of the three sources that alerted SBI on 16 October 2026, and SBI engaged a CERT-In-empanelled firm to investigate. Reporting to CERT-In protects the system; reporting to customers, under the DPDP Act, comes later.
Where to go next
Take the 22 October 2026 quiz: 30 Prelims-style questions with answers