SBI Chairman Says Root-Cause Investigation Into Customer-Data Exposure Is Still Under Way

New update on an existing SBI incident

State Bank of India (SBI) chairman C. S. Setty said on 3 November 2026 that an investigation into a reported exposure of customers’ information was continuing. Speaking around the bank’s quarterly-results announcement, he described a focus on containment, understanding the cause and correcting vulnerabilities. Fortune India carried the remarks, and Reuters separately reported that SBI intended to improve its cyber defences in the wake of the incident.

The distinction between the dates matters. The customer-data disclosure was made in October; the development on 3 November was the chairman’s update on the unfinished investigation and response. It was not a second breach or a newly completed forensic report.

What SBI had disclosed in October

Reports about SBI’s 21 October 2026 exchange filing said information linked to 3,897 customer records was found on the dark web. The bank said it had activated incident-response and containment measures and engaged an independent cybersecurity agency empanelled with the Indian Computer Emergency Response Team (CERT-In) for assessment.

Investigators were expected to check the authenticity and completeness of the information and examine its possible source and the scope of exposure. The bank’s earlier public position was that its core operations, financial performance and business continuity were not materially affected. That assessment is not the same as a finding that every customer risk had already been eliminated.

What did the chairman say in November?

Setty described root-cause analysis as still under way. Root-cause work seeks to establish the actual chain of events and identify weaknesses requiring correction. The inspected reports do not contain a final public forensic report, a definitive technical route used by an intruder or an exhaustive list of the systems involved.

The same period also brought discussion of an Indian Banks’ Association industry platform to share cyber threat warnings and possible advanced-AI testing. That is a separate sector-level initiative; it is not a formal conclusion of the SBI-specific investigation.

What this means for bank employees

SBI security, technology and audit teams should rely on approved incident-response procedures, preserve relevant evidence and follow authorized remediation directions. Public accounts of an investigation are not substitutes for internal technical instructions or regulatory reporting obligations.

Branch and customer-service teams should use authentic bank guidance when answering affected customers or escalating potentially suspicious communication. Staff should not share unofficial lists of customer records, claim the investigation is complete or promise that a particular category of data is safe without reliable instructions.

Other PSB and Regional Rural Bank staff may regard the episode as a reminder of the importance of secure data access and prompt escalation. It does not, by itself, announce new universal branch processes, employee sanctions or statutory reporting deadlines.

What is still not known?

These sources do not verify a completed independent forensic report, a final pathway of the exposure or a new mandatory customer action announced after 3 November. Further official findings would be substantive new developments. Repeating the 21 October discovery alone would not qualify as new news.

Sources and References

1. Fortune India — ‘Data breach definitely a concern’: SBI Chairman C.S. Setty (2026-11-03)
2. Reuters — State Bank of India quarterly profit rises; to boost cybersecurity after breach (2026-11-03)
3. The Economic Times — SBI flags dark web exposure of 3,897 customer records (2026-10-21)