Digital Rights Group Presses SBI Over Silent Breach Disclosure

Nearly four thousand State Bank of India customers whose phone numbers, dates of birth and home addresses have surfaced on the dark web still do not know, officially, that their data has been compromised. The Internet Freedom Foundation said on October 21 that SBI's regulatory filing on the breach makes no mention of whether any affected customer has actually been told, five days after the bank first received alerts about the exposure.

A Filing That Reassures Investors but Not Customers

SBI's disclosure to the stock exchanges was written in the language of risk management: the incident, it said, has no material impact on operations, financial performance or business continuity. That framing serves shareholders and regulators who track systemic risk at India's largest lender. It does nothing for the 3,897 individuals whose personally identifiable information, or PII, is now in circulation among parties with no legitimate claim to it. IFF's objection is precise: a filing can satisfy exchange disclosure norms while still leaving the people most exposed to harm without a warning.

The bank's own account describes a Threat Intelligence Service Provider, the Defence Cyber Agency and CERT-In flagging the exposure on October 16. Preliminary analysis pointed to 3.75 lakh records appearing on the dark web, with a smaller subset of customer records found to contain PII. The gap between discovery and public acknowledgement, and the further gap between acknowledgement and any customer-facing notification, is the crux of IFF's complaint.

Why Notification Timing Matters

Stolen banking data of this kind is typically used in impersonation fraud. Callers posing as bank officials gain instant credibility by reciting a customer's real account details, address or date of birth back to them, which is precisely why fraud of this type depends on victims not knowing their information has already leaked. A customer who has been told their data is compromised can treat an unsolicited call with suspicion; one who has not been told has no such defence. This is the practical reasoning behind data protection regimes worldwide that mandate breach notification within fixed windows, rather than leaving timing to the discretion of the entity that suffered the breach.

Five Demands and a Regulatory Gap

IFF's statement set out specific steps it wants SBI and regulators to take:

• Notify every affected customer through SMS, email and letter, in English, Hindi and the relevant local language, detailing what data was exposed and what protective steps to take, backed by a dedicated helpline and an online checker.
• Disclose the full scale and contents of the breach, including what the 3.75 lakh records and 2,722 documents contain, the precise number of affected customers, and whether KYC documents such as Aadhaar, PAN or passport details were involved.
• Publish, once the investigation concludes, an explanation of how the leak occurred, including any vendor or direct selling agent involvement, along with a summary of the investigating agency's findings.
• Have the Reserve Bank of India impose a fixed deadline for all regulated entities to notify customers of breaches, pending full enforcement of the Digital Personal Data Protection Act.
• Have the Ministry of Electronics and Information Technology immediately bring into force Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, the provisions governing breach notification.

That last demand points to a genuine regulatory vacuum. The DPDP Act was passed in 2023, but its breach-notification machinery has not been operationalised, which means incidents like this one are currently handled under a patchwork of sectoral guidance rather than a uniform statutory duty to inform individuals. Until that changes, banks retain considerable discretion over what they disclose, to whom, and when, leaving advocacy groups like IFF to press for transparency case by case rather than as a matter of enforceable right.