What are the legal avenues available to SBI customers in the wake of this data breach with mobiles details and address details along with loan details?
Data security breach was spotted by State Bank of India (SBI) allowing details of several customers to be lost. This includes mobile numbers, residential addresses, place of birth, email id and loan account details information on the dark web.
This was revealed by the biggest public sector bank in India to stock exchanges, that at the beginning of approximately 3.75 lakh records it discovered information data of 3,897 customers on the dark web.
The bank got an alert regarding the suspected vulnerability from its threat intelligence service provider on 16th October and from the Indian Computer Emergency Response Team (CERT-In).
SBI has appointed an independent cyber security firm to investigate. The bank’s normal functioning hasn’t been affected, the bank said. It has also assured the customers that their account balances and funds in their accounts are secure.
image
Need Help With Your PhD or LLM Thesis?
Explore our thesis and dissertation writing support services for PhD and LLM students. Get subject-specific academic assistance for your research project.
Explore Our Services →The Indian Express
This incident has made a point of law. What do customers have to do if information given to a bank is shared without permission?
Which Customer Data Was Revealed?
As per SBI’s disclosure, the records had names, registered mobile number, gender, dob, email id and home address of the SBI account holders.
There was also information about CIF numbers, branch numbers, lead ID, and loan application information.
The purpose of CIF number is to identify the customer and keep a track of their banking relationship. The information of an individual application or transaction can be used in any loan transaction.
The bank has failed to prove that the 3.75 lakh files are from different affected customers. Its preliminary report refers to 3,897 records that had personal information.
Investigators are going to continue to investigate the source and if there was more data breached.
image
India News
How being exposed to personal data can be harmful?
The phone number or address of a residence may appear harmless in and of itself.
But this alters when we receive several details about the same individual.
A fraudster might call the customer and mention the customer’s full name, the branch they are in or an earlier application for credit. The caller may appear to be convincing since they may already know information that the bank does.
This information can be used by scammers to send fake loan offers, email or SMS to customers asking them to update their KYC information.
However, there is a difference between exposure of personal information and the theft of money. The newspaper’s report is not an indication that the passwords, pins or bank accounts of the readers affected were accessed.
image
NDTV
Are Customers protected by the Indian Law against data breaches?
The Digital Personal Data Protection Act, 2023 has been enacted in India to protect the use of personal data.
The law requires organisations covered by its scope to take sensible measures to protect personal data and details about a personal data breach could be made public to those affected and authorities.
However, we have a problem of law here in this present case.
Some important provisions of the Act are being progressively implemented, whereas the Digital Personal Data Protection Rules have been notified in November 2025.
The provisions regarding the security protections, mandatory breach notification and important rights of customers will take effect on 13 May 2027.
But, as the conditions are not in place today, customers cannot today treat those provisions as if they are binding on an SBI for the event in 2026.
Depending on the circumstances and if a consumer suffered a loss, other banking laws and legal remedies may also be available.
image
India Code
Is there a way for SBI customers to lodge a complaint against the bank?
Yes. In the event the customer thinks that his/her personal data has been breached, SBI can identify the data breach by following the complaint process that was established at the time of its original occurrence.
The complaint may also request the bank to acknowledge whether the personal details of the customer have been breached, and, if they have, the type of records that have been compromised and the steps taken to protect the customer’s data.
If you have any suspicions of misuse, customers are also able to request that we provide a written explanation.
The grievance should include the issue and include any correspondence sent to the bank.
On the 23rd, SBI announced that it personally sent customers who were found to be involved an e-mail and WhatsApp message, on 23rd October.
Customers should not assume that their information has been breached if they didn’t receive a letter in this manner. They can try and find out themselves from the bank.
image
The Economic Times
Are customers eligible to approach RBI Ombudsman?
This can be made to the RBI by the customer under the Reserve Bank Integrated Ombudsman Scheme, 2026, if an issue with the SBI does not get resolved to the satisfaction of the customer.
The scheme has replaced the previous 2021 scheme and began on 1 July 2026.
Typically a complaint to the bank is a prerequisite. The bank, if found non-responsiveness and/or giving unsatisfactory reply within 30 days or even without replying, then the customer can refer the matter to the RBI Ombudsman.
No, no fee! Complaint can be submitted through RBI Complaint Management System.
But the Banking Ombudsman deals with complaints about poor banking services. No presumption arises that the bank has to pay compensation, just because the customer’s information was available on the net.
It would make a difference as to the facts of the individual complaint and any actual loss.
image
RBI
What if money is stolen after the Data Leak?
It is another matter, however, if a customer finds an unauthorised transaction.
