Nearly four thousand State Bank of India customers have had their phone numbers, dates of birth and home addresses exposed on the dark web, yet the bank's own regulatory filing makes no mention of whether any of them have been told. That gap is what prompted the Internet Freedom Foundation to issue a pointed statement on October 21, five days after SBI first learned of the incident, questioning why a disclosure built to reassure shareholders said nothing to the customers whose personal data is now circulating among fraudsters.
What SBI disclosed, and what it left out
SBI's exchange filing described a cyber incident flagged by its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In, which pointed to the suspected exposure of customer data on the dark web. The bank said preliminary analysis found roughly 3.75 lakh records online, with 3,897 customer records containing personally identifiable information, or PII. It stressed that the breach has no material impact on core operations or financial performance. That framing, IFF noted, speaks to investors and regulators but is conspicuously silent on whether affected account holders have received any warning at all.
This distinction matters because the kind of data involved - phone numbers, birth dates, home addresses - is precisely what enables convincing impersonation fraud. A caller who already knows a customer's address and date of birth can sound credible while posing as a bank official, extracting one-time passwords or prompting panicked transfers. Without a direct notification, customers have no way of knowing they are now higher-risk targets.
The five demands from IFF
IFF's statement sets out a concrete list of actions it wants SBI and regulators to take:
- Notify every affected customer through SMS, email and letter, in English, Hindi and the relevant local language, explaining exactly what data was exposed and what precautions to take, backed by a dedicated helpline and an online checking tool.
- Disclose the full scale and content of the breach, including what the 3.75 lakh records and 2,722 documents actually contain, and whether KYC material such as Aadhaar, PAN or passport details is among them.
- Explain, once the investigation concludes, exactly how the data leaked, including any role played by vendors or direct selling agents, and publish a summary of the investigating agency's findings.
- Have the Reserve Bank of India set a firm deadline for all regulated entities to notify customers of data breaches, pending full enforcement of the Digital Personal Data Protection Act.
- Have the Ministry of Electronics and Information Technology immediately enforce Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, the specific breach-notification provisions.
Why the regulatory gap matters
India's data protection framework is in an awkward transitional phase. The DPDP Act was passed in 2023, but its breach-notification machinery - the provisions IFF wants enforced without delay - has not yet been brought into force in a manner that compels timely customer disclosure. In that vacuum, banks and other data handlers largely follow securities-law disclosure norms, which are designed to protect investors from material financial risk rather than to protect individuals from identity theft or fraud. The result is a filing that can accurately tell shareholders the bank's balance sheet is unaffected while telling affected customers nothing about the fraud risk now facing them personally.
This is not a uniquely Indian problem. Breach-notification laws elsewhere, from the European Union's GDPR to various state-level rules in the United States, were built specifically to close this gap by legally obligating organisations to inform individuals, not just markets, within a fixed window. IFF's demand for an RBI-mandated deadline is effectively an appeal to import that principle into Indian banking practice while the broader DPDP machinery catches up.
What it means for customers now
Until clearer rules take hold, the practical burden falls on customers to protect themselves: treating unsolicited calls referencing personal details with suspicion, verifying any request through official banking channels rather than numbers provided by a caller, and monitoring accounts for unusual activity. IFF's intervention underscores a larger point in India's data protection debate - that disclosure obligations aimed at markets and disclosure obligations aimed at people are not the same thing, and conflating them leaves exactly the individuals most at risk the least informed.