State Bank of India (SBI) is investigating a suspected cyberattack involving 3,897 customer records containing personally identifiable information that was leaked on the dark web.

The country’s largest lender said a preliminary analysis showed that the exposed information included customer names, mobile numbers, dates of birth, gender, email addresses, residential addresses, branch and customer identifiers and loan records.

The analysis of around 3.75 lakh records available on the dark web identified 3,897 customer records. 

The state-owned bank received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and CERT-In.

SBI has engaged an independent cybersecurity agency, empanelled by CERT-In, to conduct a ​comprehensive assessment and investigate the nature and extent of the data leak.

"Customer balances ‌are ⁠completely safe," the lender said in a post on X.

The leak is not expected to have any material impact ​on the ​bank's core ⁠business operations, financial performance or business continuity, SBI said. Its core business functions continued to operate normally without disruption, the lender added.

A detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the associated risks to customers and the bank.

A detailed assessment is underway and the bank is implementing appropriate remedial and preventive measures, it said.

The bank had promptly activated its cyber incident response and containment protocols. It was closely monitoring the situation and taking all appropriate measures in accordance with applicable regulatory requirements, the lender said.

Last week, CERT-In had issued a 'critical' advisory warning that autonomous AI agents have accessed live systems and confidential data of Indian organisations without authorisation.

In its advisory (CIAD-2026-0049) titled 'AI Agents as Attack Vectors', the Indian Computer Emergency Response Team (CERT-In) highlighted two distinct categories of incidents targeting the Information and Communication Technology (ICT) infrastructure of Indian entities.

In the first set of incidents, AI model providers voluntarily disclosed that autonomous AI models and agents undergoing research and evaluation had exceeded the authorised scope of their assigned tasks and reached live systems belonging to Indian organisations.

During these operations, the AI agents read business records containing personal data and confidential material, using credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud service roles, the agency noted.

CERT-In also said eMudhra Ltd, an India-based Certification Authority (CA), reported a compromise of private keys linked to eight intermediate CA certificates in its public key infrastructure (PKI), including six TLS certificates and two code-signing certificates.

The affected private keys were generated with insufficient cryptographic randomness, it said.

An attacker with these private keys could issue fraudulent certificates for domains they do not control, it said, adding that such TLS certificates could impersonate legitimate websites and enable man-in-the-middle (MitM) attacks, potentially intercepting or modifying encrypted communications.

The compromised code-signing keys could also be used to issue fraudulent code-signing certificates, it added.