State Bank of India (SBI), the country’s largest lender, is investigating a data leak after identifying 3,897 customer records containing personally identifiable information among records found on the dark web. In a stock exchange disclosure on Wednesday, the bank said the source and extent of the exposure were still being investigated. The incident is the latest in a growing number of cyber security breaches involving Indian banks and their technology providers. Some incidents exposed personal information, while others enabled fraudulent withdrawals or disrupted payment services. Here are some of the major cases that exposed vulnerabilities in India’s banking systems recently. 1. SBI data exposure: October 2026 SBI received alerts on October 16 from its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In) about suspected customer data exposure. A preliminary examination of around 375,000 records found on the dark web identified 3,897 customer records containing personally identifiable information. The data reportedly included names, mobile numbers, dates of birth, email and residential addresses, customer identification details and metadata associated with loan records. SBI said it has activated its cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to investigate the incident. The bank said the breach does not have any material impact on the bank’s core business operations, financial performance or business continuity 2. Bank of Baroda: July 2026 Bank of Baroda disclosed a cybersecurity incident involving business email compromise, according to its exchange filing dated July 27. The dataset was advertised on a dark-web site as containing more than 700GB of information, based on an analysis of the site’s metadata, according to media reports. The bank initiated a forensic investigation and said the incident was not expected to have a material impact on its operations, financial performance or business continuity. 3. ICICI Bank ransomware claim: January 2025 and April 2024 The BASHE ransomware and cyber extortion group claimed in January 2025 that it had breached ICICI Bank and threatened to release data unless its demands were met. The claim was reported on January 23, with an initial ransom deadline reported for January 24. ICICI Bank did not publicly confirm the alleged breach. The Reserve Bank of India (RBI) penalised ICICI Bank ₹97.80 lakh on April 29, 2025 for non-compliance with guidelines regarding its Cyber Security Framework in Banks, KYC rules, and card-issuance regulations. In April 2024, ICICI Bank’s digital channels incorrectly mapped about 17,000 newly issued credit cards to the wrong users. Customers reported that the iMobile Pay app was displaying other customers’ card details due to a technical glitch, including full card numbers and CVVs, the security codes used for card-not-present transactions. The bank said the affected cards represented about 0.1 per cent of its credit card portfolio. ICICI Bank acknowledged the exposure of credit-card information, blocked the affected cards and began issuing replacements. It said no misuse of the cards had been reported and promised to compensate customers for any financial loss resulting from the incident. The bank did not report confirmed customer losses arising from the error. The incident was a significant exposure of sensitive card information, but the bank’s statement did not establish that the exposed details had been used fraudulently. 4. Alleged PNB data leaks In November 2021, cybersecurity firm CyberX9 alleged that a vulnerability in a Punjab National Bank (PNB) server had potentially exposed the personal and financial information of around 180 million customers for approximately seven months, according to media reports. PNB denied that its systems had been breached or customer data stolen. It said it had checked the relevant information systems and found no breach of the kind alleged. In February 2018, details associated with around 10,000 PNB debit and credit card accounts was offered for sale online. The information reportedly included cardholder names, expiry dates, personal identification numbers (PINs) and card verification values (CVVs). Singapore-based cybersecurity firm CloudSek detected the data and alerted the bank through a government agency. The bank denied the claim and said its security infrastructure is robust. 5. 300 cooperative banks and regional rural banks: July-August 2024 A ransomware attack on C-Edge Technologies, a banking technology service provider, disrupted payment services at nearly 300 cooperative banks and regional rural banks. Ransomware is malicious software that locks or encrypts systems, often to demand payment. The National Payments Corporation of India (NPCI) temporarily isolated C-Edge from its retail payment network to prevent the attack from spreading. The affected institutions accounted for around 0.5 per cent of India’s payment-system volumes, according to a Reuters report. NPCI’s precautionary action temporarily prevented customers of banks served by C-Edge from accessing affected payment systems. By August 1, the banks were back online. NPCI said a forensic review found that the ransomware had not spread to the lenders’ own systems and remained confined to C-Edge’s infrastructure.
Click Here For The Original Source.
——————————————————–
