CPI(M) Rajya Sabha MP A A Rahim has called for an independent investigation into the reported exposure of customer information belonging to the State Bank of India (SBI). In a letter dated October 21, 2026, Rahim urged Union Finance Minister Nirmala Sitharaman to ensure a thorough examination of the incident and introduce urgent measures to protect customers whose personal information may have been compromised. The demand follows an SBI disclosure concerning an incident involving the loss of certain data. The bank informed the Bombay Stock Exchange and the National Stock Exchange about the matter on October 21. According to the report, 3,897 customer records containing personal information were identified within a much larger collection of approximately 3.75 lakh records found on the dark web. Rahim said the incident raised concerns about the effectiveness of cybersecurity and data protection measures at public-sector banks. He argued that customers entrust financial institutions with sensitive personal information and should receive adequate protection against unauthorised exposure. In his communication to the finance minister, the MP called for a comprehensive and independent inquiry with clear timelines. 

What Happened in the SBI Customer Data Incident?

The SBI data leak concerns a reported exposure of customer-related information discovered in a collection of records available on the dark web. On October 21, SBI informed the country's two major stock exchanges that it had experienced an incident involving the loss of certain data. The report stated that 3,897 customer records containing personal information were identified among approximately 3.75 lakh records. These figures refer to the records described in the report. They should not be interpreted as confirmation that every record in the larger collection belonged to an SBI customer or that every individual record was successfully accessed or misused by criminals. The bank reportedly became aware of the incident on October 16. It received information through its threat intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, commonly known as CERT-In. The discovery and subsequent disclosure have raised questions about the nature of the information involved, the circumstances of its exposure and the steps required to protect customers who could be affected.

What Personal Information Was Reportedly Exposed?

The reported records contained several categories of personal and customer-related information. According to the report, these included:

• Names and gender information.

• Registered mobile phone numbers.

• Dates of birth.

• Email addresses.

• Residential addresses.

• Bank branch details.

• Customer Information File identifiers, commonly known as CIF identifiers.

• Lead identification numbers.

• Metadata associated with loan records and other files.

The combination of these details is a concern because personal information can potentially be used to make fraudulent communications appear legitimate. For example, a scammer who knows a person's name, mobile number and bank-related details may attempt to impersonate a bank representative. A fraudulent caller could use some of the information to make a call or message seem authentic and then try to persuade the customer to disclose additional confidential information. However, the reported exposure does not establish that every affected person has experienced fraud or that the information has been used for criminal purposes. The actual level of risk will depend on which records were exposed, who accessed them and whether the information has been exploited. The incident highlights the importance of assessing not just the number of records involved but also the sensitivity of the information and the potential consequences for the people concerned.

Why A A Rahim Wrote to Finance Minister Nirmala Sitharaman

In his letter, A A Rahim raised concerns about whether the data protection and cybersecurity safeguards maintained by public-sector banks are adequate to protect customers' information. He argued that the seriousness of a data exposure cannot be measured only by whether banking services continue to function normally. Even when a bank's core operations are unaffected, the potential compromise of personal information can create risks for customers long after the initial incident. Rahim's letter called for the finance ministry to ensure a comprehensive and independent investigation. He also urged the authorities to establish clear timelines for determining the source and extent of the suspected breach. Another central demand was accountability. Rahim called for responsibility to be fixed for any security failures identified through the investigation. His intervention places the responsibility for addressing the incident on both the technical and customer-protection fronts. The inquiry would need to examine how the data was exposed, while the response to affected customers would need to explain the risks and provide practical assistance.

MP Calls for Direct Alerts to Affected SBI Customers

One of Rahim's key demands was that SBI should directly notify customers whose records may have been exposed. Direct communication can help people understand whether they may be at risk and what precautions they should take. Without clear information, customers may find it difficult to distinguish legitimate bank communication from messages or calls designed to steal personal or financial details. Rahim urged SBI to use accessible communication channels to inform affected individuals. He also called for the bank to provide appropriate assistance and ways for customers to report suspected fraud. The demand for direct notification is important because a general public statement may not give an individual enough information to respond to a potential threat. Affected customers may need specific guidance on recognising suspicious communications, reporting attempted scams and seeking help if they believe their information has been misused. The report does not establish whether SBI has already notified all potentially affected customers. Rahim's request was for direct notification and support to be included in the response to the incident. Any notification process would also need to communicate the known facts clearly, avoid unnecessary alarm and explain the precautions customers should follow.

How Exposed Data Could Increase the Risk of Financial Fraud

The SBI customer data exposure has raised concerns about several possible forms of misuse, including identity theft, targeted phishing, impersonation and financial fraud. These risks can arise when personal information is combined with deceptive messages or calls. Criminals may use names, phone numbers, addresses or other identifying details to make their approaches seem credible.

Targeted phishing attempts

Phishing involves fraudulent messages or websites designed to trick people into sharing passwords, banking credentials, one-time passwords or other sensitive information. When a scammer already has some personal details, a message may appear more convincing because it refers to information associated with the recipient.

Read Also: DRDO Employee Dies After Neighbour Punches Him in Hyderabad

Impersonation of bank representatives

A fraudster may pretend to represent a bank and use exposed information to establish false credibility. The caller might claim that a customer's account needs verification or that an urgent security issue requires action. Customers should be cautious of unexpected calls or messages asking them to reveal confidential information, approve unfamiliar transactions or follow unverified links.

Identity misuse

Names, dates of birth, addresses and other identifiers may be misused in attempts to impersonate individuals or support fraudulent applications. Whether such misuse is possible in a particular case depends on the information available and any additional checks required by the relevant service.

Financial scams

Exposed contact and banking-related information may be used to target people with fraudulent payment requests or misleading claims about loans, accounts and transactions. These are potential risks associated with personal data exposure, not confirmation that the reported SBI incident has already resulted in these forms of fraud. Rahim warned that customers could face such threats and stressed that they should receive timely information and institutional support.

SBI Says Core Banking Operations Remain Unaffected

According to Rahim's letter, SBI had indicated that its core operations remained unaffected by the incident. That point is relevant to the distinction between operational disruption and the security of personal information. A bank may continue processing transactions and providing services even while an incident involving customer data requires investigation. The absence of disruption to banking services does not, by itself, establish that customer information was fully protected. Equally, the reported exposure does not prove that banking credentials or funds have been compromised. The key issue is determining what information was involved, how it was exposed and whether the incident creates risks that require additional safeguards or customer assistance. The available report does not provide a detailed technical explanation of the incident, identify the source of the data or establish whether any financial losses have occurred. Those questions would need to be addressed through the bank's investigation and any independent inquiry that may follow.

Why an Independent Probe Matters

An independent investigation could help establish the circumstances surrounding the reported data exposure and determine whether existing security controls were sufficient. The scope of such an inquiry could include examining how the records were accessed or collected, identifying any weaknesses in data protection, assessing the potential impact on customers and reviewing the measures taken after the incident was detected. A clear timeline would also help establish when the exposure occurred, when it was discovered and how the response was managed. These details can be important when determining whether the relevant safeguards and reporting procedures worked as intended. Rahim's request for accountability reflects the need to identify any failures supported by evidence rather than making assumptions about responsibility before the investigation is complete. The incident also raises broader questions about how financial institutions communicate with customers following a suspected data breach. Timely, accurate information can help customers recognise risks and take appropriate action.

What SBI Customers Should Keep in Mind

Customers who are concerned about the reported incident can take sensible precautions against scams involving personal or banking information.

• Do not disclose passwords, PINs, one-time passwords or other confidential banking credentials to callers or people contacting you unexpectedly.

• Be cautious of messages claiming that an account will be blocked unless you act immediately.

• Avoid clicking unfamiliar links in emails, text messages or messaging apps that claim to come from a bank.

• Verify unexpected requests through the bank's official communication channels.

• Review account activity and report suspicious transactions or attempted fraud promptly.

• If you receive a suspicious call or message, avoid sharing further personal information and use official reporting channels to seek assistance.

These are general precautions for reducing the risk of digital banking fraud. They do not mean that a particular customer's account has been compromised. Customers should rely on verified communication from their bank for information about any specific impact on their records. They should also be wary of people who use news about a data breach to demand money or confidential details under the pretext of providing security assistance.