State Bank of India said on Wednesday that an incident involving the loss of certain data had exposed the personal information of 3,897 customers on the dark web, a disclosure that puts India's largest lender at the centre of growing concern over cyber security in the country's financial sector.

In a filing to Indian stock exchanges, the bank said a preliminary review of about 375,000 records found on the dark web had identified 3,897 customer records containing personally identifiable information.

The records included customers' names, gender, registered mobile numbers, dates of birth, email addresses and residential addresses. They also carried branch and Customer Information File identifiers, lead IDs, and metadata linked to loan and lead records and other related files.

SBI said it received alerts on 16 October from its threat intelligence service provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team, or CERT-In, about the suspected exposure. The bank said it activated its cyber incident response and containment protocols and appointed an independent cybersecurity agency approved by CERT-In to carry out a full assessment.

The lender said the incident had no material impact on its core business operations, financial performance or business continuity, and that its core functions were operating normally. It said a detailed assessment was under way and that remedial and preventive measures were being implemented as required.

The filing leaves several important questions open. SBI said the investigation must establish the authenticity and completeness of the exposed data, identify its possible source, and determine how far the exposure went and what risk it poses to customers and to the bank. It did not say whether the affected customers had been contacted, and it did not name any person or group behind the leak.

The bank also did not say whether copies of identity documents, such as passports or national identification papers, were among the records. Until those points are answered, the full significance of the incident remains uncertain.

The difference between the two figures in the filing matters. SBI reviewed about 375,000 records on the dark web but identified 3,897 containing personal information, which suggests that much of the material circulating may be duplicated, unrelated or not genuine. The bank itself says the authenticity of the data is still being verified, so the final number of affected customers could change.

SBI is India's largest commercial bank and is majority-owned by the government. It has a very large retail customer base and operations in several countries, which means a data exposure at the lender can reach well beyond India's borders.

The disclosure comes as India's banking regulator has been pressing lenders to strengthen their cyber defences in recent years, amid a rise in threats targeting financial institutions. Banks hold some of the most sensitive personal information collected in any industry, including identity records, income details and loan histories.

For customers, the immediate risk is not that someone can withdraw money with a name and address alone. The greater danger is targeted fraud: a caller who already knows a person's date of birth, home address and loan details can sound like a genuine bank officer and use that familiarity to ask for a one-time password, PIN or card number. Customers should treat unexpected calls about accounts, loans or identity checks with suspicion and contact their bank through numbers they have verified independently.

The case also matters to families in Bangladesh who hold accounts, study or work in India, or send and receive money across the border. Personal data leaked in one country can be used in another, and the tactics of impersonation fraud do not stop at frontiers.

What happens next will depend on the investigation. SBI has promised to publish the outcome of its assessment only in general terms so far, and it is not yet known whether regulators will require direct notification of affected customers, whether the remaining records on the dark web will be confirmed as genuine, or whether the source of the leak will be traced to the bank's own systems, a vendor or another party. For now, the confirmed facts are narrow: 3,897 records were identified, they contained personal and loan-related information, and an outside agency is examining how they got out.