Nearly 4,000 State Bank of India customers whose phone numbers, dates of birth, and home addresses turned up on the dark web have not been told their information is exposed, according to the Internet Freedom Foundation. In a statement issued on October 21, the digital rights group said SBI's regulatory filing made no mention of whether affected customers had been directly notified, even as the bank reassured investors the incident posed no material risk to its operations.
A Gap Between Regulatory Disclosure and Customer Notice
SBI's filing to stock exchanges described a data loss incident first flagged on October 16, 2026, when the bank received alerts from its threat intelligence provider, the Defence Cyber Agency, and CERT-In about suspected exposure of customer data on the dark web. Preliminary findings pointed to roughly 3.75 lakh records online, with 3,897 customer records containing personally identifiable information, or PII, specifically identified. The bank's public statement focused on reassuring shareholders that core operations and financial performance remained unaffected. IFF's objection is that this is a different audience from the one actually at risk. Investors need to know about financial exposure; customers need to know their addresses and birth dates are circulating among fraudsters who can now impersonate bank officials with convincing accuracy.
The five-day gap between the initial alert and the public filing, IFF noted, is itself significant. Breach notification works best when it is fast, because the window in which stolen data is weaponised for phishing calls and social engineering tends to open immediately.
What IFF Is Demanding
The organisation's five-point charter is aimed at both the bank and the regulatory system around it:
- Direct notification to every affected customer through SMS, email, and letter, in English, Hindi, and the relevant regional language, along with a dedicated helpline and an online tool to check exposure.
- Full disclosure of what the 3.75 lakh records and 2,722 documents actually contain, how many customers are affected in total, and whether KYC documents such as Aadhaar, PAN, or passport details are part of the leak.
- A public account of how the breach occurred once the investigation concludes, including any role played by vendors or direct selling agents, along with a published summary of the investigating agency's findings.
- A Reserve Bank of India mandate setting a fixed deadline for all regulated financial entities to notify customers of breaches, pending full enforcement of the Digital Personal Data Protection Act.
- Immediate enforcement by the Ministry of Electronics and Information Technology of Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, the provisions that govern breach notification.
Why Breach Notification Rules Still Have Gaps
India's Digital Personal Data Protection Act was passed in 2023, but its breach-notification machinery is not yet fully operational, leaving a regulatory vacuum that incidents like this one expose starkly. Without an enforced legal deadline, companies can decide for themselves when, how, and whether to tell individual customers their data has been compromised, even while they are obligated to inform stock exchanges promptly about anything material to business performance. This asymmetry, treating investors as the primary stakeholders of disclosure while customers remain an afterthought, is precisely what IFF's statement targets.
The practical risk for affected customers is concrete rather than abstract. Fraudsters armed with a name, phone number, date of birth, and address can stage convincing impersonation calls, reciting personal details back to victims to establish false credibility before asking for one-time passwords or further verification. Awareness is the only defence available to someone who has not been told their information is already in circulation, which is the core of IFF's argument: disclosure obligations exist not for procedure's sake, but because warned customers behave differently than unwarned ones.