Version 1: SBI opens a cyber defence centre after 3,897 customers' details turned up on the dark web

India's biggest bank launched CyRIS on 26 October, ten days after an alert about leaked customer data. Here is what leaked and what the centre will do.

Picture this. Your name, your phone number and your home address are lying on a hidden online market, where anyone with bad plans can pick them up. For 3,897 customers of India's biggest bank, that is roughly what happened this month. And on Monday, 26 October 2026, the same bank opened a brand new centre to fight cyber attacks.

The bank is the State Bank of India, or SBI. On 26 October it opened CyRIS, a Cybersecurity Centre of Excellence. It came just ten days after SBI was warned that some of its customer data had turned up on the dark web. Here is what leaked, what the new centre will do, and what it means for anyone with a bank account and a phone.

First, how big is SBI?

Very big. SBI has about 53 crore customers, which means roughly every third Indian has an account there. In the money year that ended in March 2026 (called FY26), it made a net profit of over ₹80,000 crore. Net profit is what is left after paying every bill, like the coins left in a samosa stall's box after paying for oil, flour and rent.

SBI also has about 2.45 lakh employees. When a bank this size has a data problem, a lot of people feel it.

What exactly leaked?

On 16 October 2026, SBI received alerts from three places: its threat intelligence service provider (a company paid to watch for danger online), the Defence Cyber Agency, and CERT-In, the government team that handles cyber emergencies in India. The warning said customer data might be sitting on the dark web.

The dark web is a hidden part of the internet that normal browsers cannot open. Think of it as a dark back lane behind the main market, where stolen things are quietly sold.

SBI looked at about 3,75,000 records found there. In its first check, it found 3,897 customer records with personally identifiable information, which simply means details that can point to one real person. SBI shared this with the stock exchanges, the places where its shares are bought and sold, as listed companies must do.

Two bars: 3.75 lakh records found on the dark web, and 3,897 records with personal details — Most of the records were not personal details, but 3,897 were.

The leaked data reportedly included names, dates of birth, gender, mobile numbers, email IDs and home addresses, plus some branch and loan record details. SBI said it had informed every affected customer one by one, through email or WhatsApp, and that their account balances and money are safe.

The alert came on 16 October, and SBI told the stock exchanges on 21 October. The Hindu pointed out this five-day gap. SBI has hired an agency approved by CERT-In to find out where the data came from.

Watch on YouTube

Why is leaked data a problem if money is safe?

Because fraudsters use details to sound real. A Kaspersky security researcher told The Hindu that a password can be changed in minutes, but a photo, an ID number or an address proof cannot.

Imagine someone calls you, says your full name, your birthday and your area, and claims to be from your bank. You are far more likely to believe them. This trick is a cousin of phishing: a fake message or call that acts like bait on a fishing hook, hoping you bite and share a secret like an OTP.

So what is this new centre?

A centre of excellence is a place where a company puts its best people and tools for one job. Think of a cricket academy where the top coaches train players only in batting. CyRIS is SBI's academy for cyber safety.

It was opened by Sanjay Lohiya, secretary of the Department of Financial Services, with SBI chairman Challa Sreenivasulu Setty present. It is built on three pillars:

Think: cyber rules, a cyber academy to train people, and awareness drives for citizens.
Innovate: research, new tools, and checking how SBI's safety compares with the best in the world.
Defend: spotting attacks early, responding faster and staying prepared.

Its work will cover threat intelligence, digital forensics (studying what attackers left behind, like a detective checking fingerprints), malware analysis (studying harmful software), ethical hacking (friendly hackers testing the bank's locks before real thieves do), fraud analytics, AI security and quantum-safe technology. The centre will also work with the government, regulators, other banks, fintech firms and colleges.

Before and after panels: leak alert on 16 Oct 2026, CyRIS opens on 26 Oct 2026 — Ten days separate the leak alert and the opening of the new centre.

What did the leaders say?

Setty said, "Cybersecurity is fundamental to customer trust and the resilience of our digital financial ecosystem." Lohiya called CyRIS "a timely initiative" to build skills, teamwork and readiness across the system. Both lines are from the official statement.

What about SBI's own staff?

Every bank worker can be a door for attackers, so training matters. SBI said that in FY26, nearly 1.81 lakh employees completed mandatory cybersecurity e-learning. That is about three out of every four of its 2.45 lakh staff. The bank also says it uses layered security, regular audits, cyber drills and customer awareness drives.

A counter rising to 1.81 lakh SBI staff who finished cyber safety lessons in FY26 — About three in four SBI employees finished the cyber safety course in FY26.

What this changes for a normal customer

For most people, the leak is a reminder that your details can travel far from the bank. The bank's own advice, given after the leak, is to never share an OTP, PIN or password with anyone, and to watch out for strange calls, messages and emails.

Security experts quoted by The Hindu added a few simple habits:

Do not click links in messages that claim to be from the bank.
Turn on two-step login and transaction alerts, so every payment pings your phone.
Treat any call about KYC updates, loans or a blocked account as fake until you check it in the bank's app or at a branch.

Watch on YouTube

The bigger picture

More of India's money now moves through phones, from UPI payments to app loans. That makes banks a bigger target. A leak of 3,897 records is small next to 53 crore customers, but trust is like a glass of chai: easy to spill, slow to refill. With CyRIS, SBI is trying to show it can spot the next attack before it reaches anyone's phone.

As it was first published

SBI opens a cyber defence centre after 3,897 customers' details turned up on the dark web