SBI Discloses a Cyberattack to the Stock Exchanges After Customer Records Surface on the Dark Web
On October 21, 2026 the State Bank of India told the stock exchanges that it had been the subject of a cyberattack. That SBI discloses a cyberattack to the market at all is a function of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, and the filing repays close reading, because the obligation it discharges is a securities law obligation and not a data protection one.
What the Bank Disclosed
According to the disclosure as reported, the bank was alerted on October 16, 2026 by its threat intelligence service provider, by the Defence Cyber Agency and by the Indian Computer Emergency Response Team. A preliminary examination of about 375,000 records found on the dark web identified 3,897 customer records containing personally identifiable information.
The fields reported as affected are names, dates of birth, gender, residential addresses, registered mobile numbers, email addresses, customer information file numbers, lead identifiers and metadata relating to loans and associated documents. The bank said the source and extent of the exposure were still under investigation, and that it had activated its cyber incident response and containment protocols and engaged an independent agency empanelled with the Response Team to investigate.
Why the Two Figures Are Not the Same Thing
The two numbers in the account do different work and should not be run together. About 375,000 is the size of the body of records found on the dark web and examined; 3,897 is the number within it that the preliminary examination identified as customer records containing personally identifiable information.
So the larger figure describes what was looked at and the smaller one what was found so far. Both are expressly preliminary, on a review the bank described as still under way, which means the smaller figure is capable of moving in either direction as the examination continues. Reporting that compresses the two into a single headline number states something neither figure supports.
The Materiality Statement and Why It Is There
The bank stated that the incident does not have any material impact on its core business operations, financial performance or business continuity, and that it continues to monitor the situation closely.
That sentence is doing legal work rather than public relations work. A disclosure under the Listing Obligations and Disclosure Requirements Regulations turns on materiality to the listed entity, so a statement about impact on operations, financial performance and continuity is responsive to the standard the Regulations apply. It is not an assessment of the effect on the individuals whose records were exposed, and it does not purport to be one.
What the Disclosure Is Not
Nothing in a filing of this kind is an intimation to the individuals concerned. The two obligations run to different audiences: one to the market through the exchanges, the other to the persons whose personal data is involved. Neither outlet reporting the filing records any intimation to the affected customers.
Nor is the filing a determination of anything. It records what the bank knew on the date it was made, on its own account, while the source and extent remained under investigation. A later filing may say something different, and the questions of fact that matter legally are not resolved by the first one.
The Data Protection Obligation That Is Not Yet in Force
The duty that would ordinarily be expected to govern an event of this kind sits in section 8 of the Digital Personal Data Protection Act, 2023, which requires a Data Fiduciary to give intimation of a personal data breach to the Data Protection Board of India and to each affected Data Principal. Chapter II of that Act, in which section 8 sits, comes into force eighteen months after publication of commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027.
So the position today is uneven. The definitions in section 2 of the Act came into force on publication of that notification, and the Schedule to the Act keys a penalty to a failure to give that intimation, but the obligation itself has not commenced and the Board's power to inquire has not commenced either. The vocabulary of the Act is available; its breach duties are not.
What Does Apply Today
What an event of this kind engages today is the securities and sectoral framework rather than the data protection statute. For a listed entity the exchange disclosure obligation under the Listing Obligations and Disclosure Requirements Regulations applies, and the bodies reported to have raised the alert in this matter were a threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, none of them acting under the Act.
The practical consequence for advisers is that an incident in 2026 is assessed against a different set of instruments from an identical incident in 2027. Dating the incident, and dating each step taken in response to it, therefore matters more during this period than it will afterwards.
Key Takeaways
The filing was a securities law disclosure: It was made to the stock exchanges under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015.
The materiality statement is measured against the listed entity: It addresses core business operations, financial performance and business continuity.
An exchange filing is not an intimation to individuals: The two obligations run to different audiences.
The figures are preliminary: About 375,000 records were examined and 3,897 customer records with personally identifiable information were identified, with the source and extent still under investigation.
The data protection duty has not commenced: Chapter II of the Digital Personal Data Protection Act, 2023 comes into force eighteen months after publication of the commencement notification.
Dates are the controlling fact: An incident in 2026 and the same incident in 2027 are assessed against different instruments.
Key Statutory Provisions
SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015: The framework under which a listed entity discloses events or information to the stock exchanges, and under which this disclosure was reported to have been made.
Section 8 of the Digital Personal Data Protection Act, 2023: General obligations of a Data Fiduciary, including the duty to give intimation of a personal data breach to the Data Protection Board of India and to each affected Data Principal. It sits in Chapter II and has not commenced.
Section 2 of the Act: Definitions, including personal data breach in clause (u), which came into force on publication of the commencement notification.
Commencement notification G.S.R. 843(E) dated November 13, 2025: Brings the definitions into force on publication and places Chapter II, including section 8, in the group commencing eighteen months after publication.
Sources and References
Report of the disclosure, with the figures and the fields affected
Section 2 of the Digital Personal Data Protection Act, 2023, bare text
Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Chapters I and II
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments