The Lift Line
“Identity data can cause more damage than a stolen password.” (Lalatendu Mishra, The Hindu FAQ, 25 October 2026)
Why This Explainer Matters for Your Exam
The Hindu explains, in a FAQ by Lalatendu Mishra on 25 October 2026, what the data breach disclosed by the State Bank of India (SBI), India’s largest commercial bank, means for its customers: what information is at risk, what customers should do, how to complain, and what banks and regulators should do. Underneath runs a legal question an examiner can ask: when customer data leak, who has to be told, by whom, and by when?
GS Paper 3: challenges to internal security through communication networks; basics of cyber security; banking. GS Paper 2: statutory and regulatory bodies (CERT-In, the Data Protection Board, the RBI, SEBI). GS Paper 4: an institution’s duty of care to the people whose data it holds. Earlier coverage: the FSDC and the financial sector’s Cyber Security Strategy (23 October), CERT-In’s AI agents advisory, the Data Protection Board in the 12 October roundup, and the DPDP Rules’ phased dates in the piece on UPI number masking.
The Crux in 60 Words
SBI says customer records holding personal identifiers have turned up on the dark web; how they got there is under investigation. Mishra’s FAQ explains why that matters: identity data, unlike a password, cannot be reset, and fraudsters use them to sound like the bank. Yet the law that would oblige banks to tell affected customers is not yet in force.
Lalatendu Mishra’s FAQ in The Hindu shows that a bank’s customers carry the risk when identity data leak, yet the duty to tell them, under section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, is not yet in force, which is why the Internet Freedom Foundation wants the RBI and MeitY to act now.
- Identity data are worse to lose than a password: a password can be reset in minutes, but a photograph, ID number and address proof cannot, says Kaspersky’s Saurabh Sharma, and fraudsters combine names, addresses and dates of birth into ‘digital dossiers’.
- The disclosure went first to the markets: SBI told the stock exchanges under SEBI’s norms, and later said it had informed each customer it identified by email and/or WhatsApp.
- The reporting duties in force today, under the CERT-In Directions of 28 April 2022 and the RBI’s cyber security framework for banks, are owed to regulators and not to customers, the Internet Freedom Foundation argues.
- The DPDP Act’s breach duties and its penalties are on a staggered commencement and not yet in force, so even a proven failure to notify cannot be penalised under the Act yet.
Telling customers before a leak is verified risks alarm over data whose authenticity, completeness and source SBI says still need a detailed investigation; SBI says account balances and funds are safe, and it has now informed the customers it identified.
An interim RBI direction on time-bound notice to customers, early commencement of section 8(6) and Rule 7, less data held and KYC records encrypted by banks, and customers treating every call about loans, KYC or account blocks as fraud until verified.
Background and Context
What SBI disclosed
- The alert. SBI received alerts from its Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In about the suspected exposure of customer data on the dark web. Five days later, on 21 October, it informed the stock exchanges, in a disclosure made under the norms of the Securities and Exchange Board of India (SEBI).
- The count. SBI told the exchanges: “During the preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing Personally Identifiable Information were identified”. That is about one record in a hundred.
- The fields. According to SBI, as The Hindu reported, the exposed information included registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan or lead records. Reports say the alleged dataset also includes loan applications, KYC documents and account-opening forms; that is the reports’ description, not SBI’s.
- What is not known. SBI said a detailed investigation was required to establish the authenticity and completeness of the exposed data, determine the potential source and extent of the exposure, and assess the risks. The claim of a leak comes from an actor using the name Siriusim; of its identity, Kaspersky researcher Saurabh Sharma told The Hindu, “We have no basis to comment on its identity or origin.”
- The customers. SBI had been criticised for telling the exchanges but not the customers affected. On 23 October it said it had individually informed all customers whose data were identified, through email and/or WhatsApp, adding: “We reiterate that your account balances and funds are safe with us.”
Why identity data matter
“The motive is almost always money,” says Sharma, of Kaspersky’s Global Research and Analysis Team: the dark web is where stolen data are aggregated, repackaged and sold, and Kaspersky has found verified “dumps” selling in bulk for as little as $50. Old data are still valuable. A password can be reset in minutes, he explained, but a photograph, ID number and address proof cannot. Attackers combine names, addresses and dates of birth into “digital dossiers” that make later scams more believable, and Kaspersky reports growing underground demand for deepfake services built to bypass KYC checks. So the customers whose records were exposed are the most likely to get calls from people posing as SBI officials who can recite their account details back to them.
What customers should do, and where to complain
- Act first. Kaspersky’s advice: assume the data are already in circulation; never share an OTP, PIN or CVV or click links in messages claiming to be from the bank; change net banking and YONO passwords, switch on two-factor authentication and transaction alerts; and treat any call about loans, KYC updates or account blocks as fraud until verified through the SBI app or a branch.
- Complain. Call the bank to block cards and accounts and report any unauthorised transaction at once; file a complaint on the National Cybercrime Reporting Portal (cybercrime.gov.in) or call 1930; if the bank does not resolve it, go to the RBI Integrated Ombudsman. Keep screenshots, messages and transaction details.
- Know the RBI rule. RBI’s July 2017 circular on customer liability, whose instructions were later consolidated in its Responsible Business Conduct Directions, 2025 for commercial banks, gives a customer zero liability in a third-party breach, where the fault lies with neither the bank nor the customer, if the customer notifies the bank “within three working days of receiving the communication from the bank regarding the unauthorised transaction”. The burden of proving customer liability lies on the bank. The rule was amended in RBI Directions of 24 June 2026, which change the window to “within five calendar days from the date of its occurrence” for electronic banking transactions undertaken on or after 1 January 2027.
Has it happened before?
Public reports recall a 2019 exposure of an unprotected server behind SBI’s SMS banking service, which SBI said did not compromise its own servers, and Bank of Baroda acknowledged a data leak in July 2026, the FAQ notes.
The Analysis
1. A breach without a known source. Nothing SBI has said establishes that its own systems were breached; it says the source is under investigation. An answer should keep that line: “data exposure” and “suspected leak” are accurate; “SBI was hacked” is not established. The harm to customers, though, does not wait for the investigation, because the data are already in circulation.
2. Told to regulators, not to customers. Every duty in force today runs upward. Since 2022, CERT-In’s Directions of 28 April 2022 have required cyber incidents to be reported to CERT-In “within 6 hours of noticing such incidents or being brought to notice about such incidents”, and the list of reportable incidents includes “Data Breach” and “Data Leak”. A listed company keeps the stock exchanges informed. The Internet Freedom Foundation, quoted in the FAQ’s online version of 22 October, put the gap plainly: these obligations “are owed to regulators and not to customers”, and, of a listed bank, “No law in force clearly binds it to inform the people whose data it holds”. That is the IFF’s reading, but it fits the text: none of these instruments names the customer.
3. The law that would fill the gap is on the books but not in force. Section 8(6) of the DPDP Act requires notice of a breach; Rule 7 of the DPDP Rules, 2025 sets out how:
- To each affected person, “without delay”: a description of the breach, its likely consequences, the measures taken to mitigate risk, the safety measures the person may take, and a contact who can answer queries.
- To the Board, “without delay”, a description of the breach, and then, “within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow”, detailed information on its causes and the steps taken.
But Rule 1(4) says Rules 3, 5 to 16, 22 and 23 “shall come into force eighteen months after the date of publication of this Gazette”, and the Act’s own commencement notification brings section 8 and section 33 in on the same clock. The Rules’ Gazette is dated 13 November 2025; counting from it, the provisions start on 13 May 2027, the date the IFF and The Hindu give. (PIB’s background note says the Rules were notified on 14 November 2025; the Gazette carries the earlier date.) The IFF calls this “nearly four years after Parliament enacted the law” and wants MeitY to bring section 8(6) and Rule 7 into force immediately.
4. Penalties that cannot yet bite. If the Board finds on concluding an inquiry that a breach is significant, it may, after a hearing, “impose such monetary penalty specified in the Schedule” (section 33(1)). The Schedule’s ceilings: a breach of section 8(5), the duty to take reasonable security safeguards, “May extend to two hundred and fifty crore rupees”; a failure under section 8(6), to give notice of a breach, “May extend to two hundred crore rupees”. Because section 33 starts on the same delayed date, neither penalty can be imposed for a breach today.
5. What protects the customer now. Two things: the bank’s own conduct, and the RBI’s rules on unauthorised transactions. The second is real but narrow: it protects money taken through a fraudulent electronic transaction, not a customer whose identity documents are now in a criminal’s file. Hence the IFF’s interim ask: that the RBI “direct all regulated entities to notify customers of personal data breaches within a fixed period, pending the commencement” of the DPDP Act.
6. Prevention is a data question. The better-prepared banks, Sharma says, are moving from perimeter defence to continuous visibility: threat intelligence, round-the-clock monitoring, vendor risk reviews and staff training. His shortest advice, in the online version: “Hold less data, guard what remains and watch the dark web.” That is data minimisation: data a bank does not keep cannot leak from it.
Data and Institutions Vault
Prelims-grade facts:
The disclosure:
- SBI: 3,897 customer records with Personally Identifiable Information, found in a preliminary analysis of about 3,75,000 records on the dark web
- Alerts came from SBI’s Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In
- Disclosed to the stock exchanges under SEBI norms; SBI says it informed identified customers individually by email and/or WhatsApp
DPDP Act, 2023 (No. 22 of 2023), enacted in August 2023 (assent 11 August 2023):
- Section 2(u): defines “personal data breach” (unauthorised processing, or accidental disclosure, loss of access and the like)
- Section 8(5): reasonable security safeguards to prevent a breach; penalty may extend to Rs 250 crore
- Section 8(6): intimation of a breach to the Board and each affected Data Principal; penalty may extend to Rs 200 crore
- Section 18: Data Protection Board of India, established in November 2025; head office in the NCR
DPDP Rules, 2025 (G.S.R. 846(E)):
- Gazette dated 13 November 2025; PIB gives the notification as 14 November 2025
- Rule 7: notice to each affected person and to the Board “without delay”; detailed report to the Board within seventy-two hours
- Rule 1(4): Rules 3, 5 to 16, 22 and 23 in force eighteen months after publication, which works out to 13 May 2027
- The Act’s sections 8 and 33 start on the same date (G.S.R. 843(E))
Cyber security:
- CERT-In: national agency for cyber security under section 70B, IT Act, 2000
- CERT-In Directions, 28 April 2022 (in force since 2022): report cyber incidents within 6 hours of noticing them; the list includes data breach and data leak
RBI and redress:
- RBI circular, 6 July 2017: zero liability in a third-party breach if reported within three working days of the bank’s communication; burden of proof on the bank
- Amended in June 2026 (Third Amendment Directions, 24 June 2026): five calendar days from the fraudulent transaction, for transactions on or after 1 January 2027
- Complaints: cybercrime.gov.in, helpline 1930, then the RBI Integrated Ombudsman
The traps:
- SBI’s count is of customer records with personal identifiers, not of customers who lost money
- Rs 250 crore is the ceiling for failing to take safeguards (section 8(5)); failing to notify is Rs 200 crore (section 8(6))
- Section 8(6), Rule 7 and section 33 penalties are not yet in force
- The RBI’s zero-liability rule covers unauthorised transactions, not a leak of data as such
The Debate
The case for the IFF’s line. The risk falls on customers, and it is immediate: calls from fraudsters who already know their names and addresses. A notice to CERT-In and the exchanges does not warn them; a customer who knows the data are out can change passwords, block cards and doubt every caller. A law passed in 2023 whose breach duty starts in 2027 leaves a long gap, which the RBI can fill for banks by direction.
The other side. SBI says the authenticity, completeness and source of the data still need a detailed investigation; a notice sent before that risks alarming customers over records that may be old, partial or not SBI’s at all. And the government’s case for the phased start, in PIB’s backgrounder, is that it “gives organisations enough time to adjust their systems and adopt responsible data practices”.
The balanced verdict. SBI’s later notice shows the gap can be closed voluntarily, but SBI’s statement came only after public criticism, and no law required the notice. Rule 7 already meets the verification worry halfway: it asks for notice “to the best of its knowledge” and “without delay”, and lets the detailed report to the Board come later. The stronger exam line is an interim, time-bound duty to tell customers, set by the sector regulator until the DPDP provisions commence.
How to Think About This
Use the “detect, report, tell, redress” lens for any data breach question:
- Detect: who found it? (Here, a threat intelligence provider, the Defence Cyber Agency and CERT-In, not the customer.)
- Report: to whom must it go, and how fast? (CERT-In, under its 2022 Directions; the exchanges, for a listed company.)
- Tell: must the people affected be told? (Not by any law in force today, in the IFF’s reading; under section 8(6) and Rule 7 once they commence.)
- Redress: what can a victim recover, and where? (Zero liability for unauthorised transactions reported in time; the cybercrime helpline and portal, and the RBI Ombudsman.)
Then keep dates straight: a law enacted, Rules notified and a provision in force are three different things.
Diagram-in-Words
The SBI data breach: who has to be told today
Covers the alert, the three parties that might be told and what binds each now, the duty that is law but not yet in force, and the protection that applies until then.
Read the figure from top to bottom: the alert, the three people or bodies who might be told and what binds each today, then the duty that is written but not yet in force. The customers’ box is the gap the FAQ is about.
A data breach at a large bank shows the gap between reporting to regulators and informing customers. Examine India's legal framework for notifying personal data breaches and suggest measures to protect customers until the Digital Personal Data Protection framework is fully in force. (250 words)
In October 2026 the State Bank of India disclosed to the stock exchanges that a preliminary analysis of about 3,75,000 records found on the dark web had identified 3,897 customer records containing personally identifiable information; the source of the exposure was still under investigation. The episode shows that India’s breach rules serve the regulator’s need to know better than the customer’s need to act.
Duties in force today run to regulators and markets. Under section 70B of the Information Technology Act, 2000, CERT-In is the national agency for cyber security, and its Directions of 28 April 2022 require cyber incidents, data breaches and data leaks among them, to be reported to it within 6 hours of noticing them.
A listed bank must also keep the stock exchanges informed under SEBI’s disclosure norms. Neither duty runs to the customer whose data were exposed.
The Digital Personal Data Protection Act, 2023 closes this gap on paper. Section 8(5) requires a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach, and section 8(6) requires it to intimate a breach to the Data Protection Board and to each affected Data Principal.
Rule 7 of the DPDP Rules, 2025 prescribes the content of the notice (the nature and extent of the breach, its likely consequences, the mitigation measures, the safety steps a person can take, and a contact), to be sent without delay, with a detailed report to the Board within seventy-two hours. Penalties may extend to Rs 250 crore for failing to take safeguards and Rs 200 crore for failing to notify.
But these provisions commence only eighteen months after the Rules were published in November 2025, so they do not yet bind banks. Meanwhile the customer’s money is protected by the RBI’s rules on unauthorised electronic banking transactions, which give zero liability when a third-party breach is reported in time and put the burden of proof on the bank; they cover money lost, not data exposed.
Measures: an interim RBI direction requiring banks to notify affected customers within a fixed period; early commencement of section 8(6) and Rule 7; less data held, KYC records encrypted and vendors held to the same controls; monitoring of the dark web; and public awareness of the 1930 helpline and the National Cybercrime Reporting Portal.
India’s breach rules were written for the regulator first and the customer last. Until section 8(6) and Rule 7 commence, an interim direction from the banking regulator and better data hygiene by banks are the quickest ways to let customers protect themselves before a fraudster calls.
Interview Angle
"You head information security at a public sector bank, and customer records that may be yours appear on the dark web, but the source is not yet clear. Would you tell customers before the investigation ends? Why?"
Takeaway Box
- Core idea: India’s breach duties in force today run to regulators and markets; the duty to tell customers (section 8(6) and Rule 7) is law but not yet in force.
- Prelims hooks: DPDP Act, 2023, sections 2(u), 8(5), 8(6), 18 and 33; DPDP Rules, 2025, Rules 1(4) and 7; IT Act, 2000, section 70B and CERT-In’s 2022 Directions; RBI zero liability.
- Ethics and Interview angle: an institution’s duty of care to the people whose data it holds, against the wish to verify before it speaks.
- Probable question: “Explain the provisions on personal data breach in the Digital Personal Data Protection Act, 2023 and the Rules made under it. Why does their commencement matter for bank customers?” (GS3, 150 words)
Sources:
- Lalatendu Mishra, “How does the SBI data breach affect customers?”, FAQ, The Hindu, 25 October 2026 (Delhi print)
- The Hindu, “SBI data breach: What information was exposed and what customers should do”, 22 October 2026; The Hindu, “Data breach: SBI says it individually informed all affected customers”, 23 October 2026
- The Digital Personal Data Protection Act, 2023 (sections 2(u), 8, 18, 33 and the Schedule), MeitY
- Ministry of Electronics and Information Technology, G.S.R. 843(E), G.S.R. 844(E) and G.S.R. 846(E) (Digital Personal Data Protection Rules, 2025), Gazette of India, 13 November 2025; PIB backgrounder, 17 November 2025
- The Information Technology Act, 2000 (section 70B); CERT-In Directions under section 70B(6), 28 April 2022
- Reserve Bank of India, circular DBR.No.Leg.BC.78/09.07.005/2017-18, 6 July 2017; Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Third Amendment Directions, 2026, 24 June 2026
Cite this page: SBI Data Breach: How It Affects Customers, and the DPDP Law — Ujiyari.com | Free UPSC & State PCS Editorial Analysis
