State Bank of India told the stock exchanges on 21 October, under Regulation 30 of the SEBI listing rules, that a preliminary review had identified 3,897 customer records containing personal information in a dataset circulating on the dark web.

That number has been the headline everywhere. The more useful reading is the structure of obligations around it, because it shows precisely who an Indian bank must tell when this happens, and who it need not.

What the filing says

The alerts reached the bank on 16 October, from its threat intelligence provider, the Defence Cyber Agency and CERT-In. It activated its incident response protocols and engaged an empanelled agency to examine "the nature and extent of the alleged compromise".

The fields it lists are registered mobile numbers, dates of birth, names, gender, email and residential addresses, branch and CIF identifiers, lead IDs, and metadata attached to loan and lead records.

The fields it does not list matter as much: no account numbers, no balances, no passwords, no one-time passcodes, no card details, and no PAN or Aadhaar numbers.

The bank also says the incident "does not have any material impact" on its core business operations, financial performance or business continuity. That sentence is doing exactly what Regulation 30 asks of it, which is to describe the effect on the company, because that is what shareholders are owed. It says nothing about the effect on a person whose date of birth, mobile number and branch are now in a file somebody is selling.

The clocks that exist

CERT-In directions from April 2022 give a regulated entity six hours from noticing a breach to report it. The Reserve Bank, in directions dated 31 July 2026, requires banks to report cyber incidents on its DAKSH platform, also within six hours of detection. SEBI requires a material-event disclosure to the exchanges, which is the filing itself.

Three obligations, two of them measured in hours, every one of them pointing at an institution.

The clock that does not exist yet

There is no matching requirement to tell the customer.

The Digital Personal Data Protection Act does contain one. Section 8(6) requires a data fiduciary to notify both the Data Protection Board and each affected individual of a personal data breach. But the rule that operationalises it, Rule 7 of the DPDP Rules, 2025, takes effect on 13 May 2027.

So for the next eighteen months the honest description of Indian practice is this: a bank has six hours to tell two regulators, days to tell its shareholders, and no deadline at all to tell the person whose details were taken.

The Internet Freedom Foundation has put that at the centre of its response, asking SBI to contact every affected customer directly, asking the Reserve Bank to direct regulated entities to notify, and asking the ministry to bring the Act and its rules into force now rather than in 2027.

What the filing leaves out

A listing reported on 19 October claimed more than 3.75 lakh rows and 2,722 PDF documents. The filing does not mention the PDFs, does not confirm the claim, and names neither the actor nor the forum.

It also names no cause. That is a choice rather than an inevitability: Bank of Baroda, filing on 27 July about its own incident, described that one as a potential business email compromise. SBI's filing says "the alleged compromise" and stops.

We made a similar point about what was actually inside the Nikkei records. A record count tells you almost nothing on its own. The field list is where the risk is, and it is the part most reporting drops.

What to do

  • If you bank with SBI, treat any call or message that already knows your name, date of birth and branch as a probable fraud attempt rather than proof the caller is genuine. That combination is exactly what this exposure enables.
  • Do not wait for a notification. Nothing currently obliges one.
  • Never read out a one-time passcode. The fields in this set are enough to make a convincing approach and not enough to move money without one.
  • If you run a regulated entity, the six-hour clocks are the ones with teeth today, and the customer-notification clock starts in May 2027 whether you are ready or not.

What is not established

  • Whether any SBI system was breached. The filing describes data found elsewhere, not an intrusion found at the bank.
  • How the data was obtained, and when it first appeared.
  • Whether the 3,897 records belong to 3,897 different people.
  • How large the dataset actually is, or what is in the rest of it. Accounts differ on whether the filing itself states a total.
  • Whether the PDF documents claimed in the listing exist.
  • Whether SBI has notified anyone or intends to. The filing says only that it will act "in accordance with applicable regulatory requirements".