AI Risk Wire

Cases › leaked private data › LR-2026-0836

SBI customer data exposure on dark web, preceded by CERT-In warning on autonomous AI agents

Preliminary Why: Publisher not yet named · subject to change

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity major
Loss or records 3,897 records
Reported 21 Oct 2026
Industry Finance and Insurance

No source states: developer and model, agent tool, could do, deployer.

Severity major: a live production compromise of a bank's customer data with an unbounded scope stated, since threat actors claimed over 375,000 entries against 3,897 confirmed records.

SBI, India's largest public lender, disclosed on 21 October 2026 a customer data exposure on the dark web involving personal records, loan applications and customer metadata. SBI learned of the breach on 16 October not internally but from external notices issued by CERT-In, the Defence Cyber Agency and a third-party threat intelligence vendor, after dark web claims had already circulated on social media. A preliminary review identified 3,897 compromised records containing PII, while external threat actors claimed over 375,000 entries and 2,722 loan documents. The article attributes the exposure to loosely monitored outsourced customer acquisition and direct selling agent pipelines. SBI issued no direct notices or advisories to affected account holders. The source notes the disclosure followed a CERT-In warning about autonomous AI agents penetrating enterprise networks.

What happened

No source tells the story step by step yet.

What was done

No source states an action or fix.

Risks

Privacy harm to a person
Primary54 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Application

Data minimisation · Sensitive-data checks on outbound data · Human approval for high-impact actions · Output filtering and redaction · People told they are dealing with AI · Risk assessment per deployment

Infrastructure / target

Bot and scraping defences

Similar incidents

CERT-In advisory: AI agents accessed Indian organisations' systems without authorisation2026-10-16

All cases of this kind ›

Evidence

No source states: a step-by-step account, when it happened, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show every field, with its source and grade

What happened

Earliest source we hold
2026-10-21
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
Themes
data breach, privacy, pii exposure, dark web leak, third party vendor risk, banking
C one secondary source states it
When it was found
2026-10-16
C one secondary source states it
Earlier warning signs
Previously, the CERT-In Advisory CIAD-2026-0049, warned that autonomous AI agents, both rogue research workloads and offensive open-source tools, have bypassed enterprise defences across Indian critical infrastructure.
C one secondary source states it
What went wrong
leaked private data
C one secondary source states it

Impact

Records exposed
3,897
C one secondary source states it
Severity
major
C one secondary source states it
Kind of harm
privacy, money
C one secondary source states it
Who was affected
SBI account holders whose personal records, loan applications and customer metadata were exposed
C one secondary source states it
Kinds of data exposed
personal information
C one secondary source states it
Can it be undone
no
C one secondary source states it
Why this severity
a live production compromise of a bank's customer data with an unbounded scope stated, since threat actors claimed over 375,000 entries against 3,897 confirmed records.
C one secondary source states it

Context

Industry
Finance and Insurance
C one secondary source states it
Size of the organisation
over 10,000 people
C one secondary source states it
Country
India
C one secondary source states it
Rules that apply
DPDP Act, CERT-In, RBI, SEBI LODR
C one secondary source states it
Notices made
SBI complied with exchange listing requirements under Sebi (LODR) regulations but issued no direct notices, consumer advisories, or helplines to affected account holders.
C one secondary source states it

Notes on gaps

The article is an opinion/analysis piece about a data breach; it does not state that an AI agent caused the SBI breach. The article does not state the date the breach occurred, only that SBI learned of it on 16 October 2026 and disclosed on 21 October 2026. Extractor proposed values without quotes; dropped: . Extractor quotes not found verbatim in document; dropped: .

LR-2026-0836 · version 1 · published 2026-11-04 after automatic checks; not yet checked field by field by a person · JSON