Data Breach Preparedness in India: Lessons Businesses Can Learn from Banking Incidents

The SBI data breach has brought an important issue back into focus: how prepared are Indian businesses to protect customer information and respond to a data breach?

On 21 October 2026, the State Bank of India (SBI) disclosed to the stock exchanges that a preliminary review of approximately 3.75 lakh records reportedly found on the dark web had identified 3,897 customer records containing personally identifiable information. The bank stated that the source and extent of the exposure remained under investigation and that its core operations were unaffected.

Although the investigation is ongoing, the incident offers important lessons for organisations that collect, store, or process personal data. From banks and fintech companies to lending startups and service providers, any business holding customer information must be prepared for the possibility of a data leak.

The key takeaway is that cybersecurity is no longer just an IT concern. It is also a business continuity, customer trust, and regulatory compliance issue.

What Happened in the SBI Data Breach?

According to the reported timeline, SBI received alerts on 16 October 2026 from its threat intelligence provider, the Defence Cyber Agency, and CERT-In regarding suspected customer information circulating on the dark web.

A threat actor reportedly using the name “Siriusim” claimed to have released approximately 3.75 lakh rows of data and 2,722 PDF documents associated with SBI.

On 21 October, SBI disclosed the incident to the BSE and NSE under Regulation 30 of the SEBI listing requirements. The bank reported identifying 3,897 records containing personal information during its preliminary review.

SBI also stated that it had activated incident response procedures and engaged an independent CERT-In-empanelled agency to investigate the matter.

The precise source of the data, the method through which it may have been exposed, and the full extent of the incident have not yet been established publicly.

These distinctions matter. A disclosure of exposed records does not, by itself, establish whether the bank's systems were directly compromised, whether a third-party provider was involved, or whether all the circulating material is authentic.

Why Exposed Customer Information Is a Serious Risk

The reported information associated with the incident includes names, registered mobile numbers, dates of birth, email addresses, residential addresses, branch details, customer identification numbers, and metadata linked to loan enquiries or leads.

Individually, these details may appear relatively ordinary. Combined, however, they can help criminals create convincing impersonation attempts.

For example, a fraudster who knows a customer's name, branch, date of birth, and loan application history may be able to pose as a bank representative. A message referring to a genuine application or a recent financial interaction can appear far more credible than a generic phishing attempt.

Such information can potentially support:

• Targeted phishing: Fraudulent emails and messages designed around real customer details.
• Impersonation scams: Calls from individuals pretending to represent a bank, lender, or financial service provider.
• Social engineering: Attempts to persuade customers to disclose OTPs, PINs, passwords, or other confidential information.
• Identity-related fraud: Misuse of personal information to support fraudulent applications or other deceptive activities.

An important lesson for businesses is that protecting personal data is not only about preventing immediate financial losses. It is also about reducing the risk of downstream fraud and protecting customers from targeted attacks.

What Indian Businesses Should Learn From the Incident

1. Build a Complete Personal Data Inventory

An organisation cannot effectively protect information it does not know it holds.

Businesses should identify the personal data they collect, the systems in which it is stored, the employees who can access it, and the external parties with whom it is shared.

This inventory should cover customer relationship management systems, cloud storage, spreadsheets, email accounts, loan management platforms, backup systems, and third-party integrations.

Organisations should also review whether all collected information is necessary for their business operations. Retaining unnecessary data increases the potential impact of an incident.

2. Strengthen Access Controls and Monitoring

Strong cybersecurity requires more than installing antivirus software or maintaining a firewall.

Businesses should enforce multi-factor authentication, apply role-based access controls, remove unnecessary permissions, and regularly review privileged accounts.

Monitoring is equally important. Alerts for unusually large downloads, unexpected access to sensitive files, suspicious login attempts, and abnormal data transfers can help security teams identify potential incidents earlier.

Access should be granted according to business need and reviewed whenever employees change roles or leave the organisation.

3. Treat Third-Party Risk as an Internal Responsibility

Customer information often moves beyond an organisation's direct infrastructure.

Banks, fintech companies, and lending businesses may share information with technology providers, outsourced service providers, marketing agencies, lead-generation partners, and cloud platforms.

A security failure at one of these organisations can expose information belonging to another business.

Companies should maintain an up-to-date vendor register, document the information shared with each provider, assess security controls, and establish clear contractual requirements for reporting incidents.

Vendor agreements should specify how quickly a provider must notify the business of a suspected breach, how evidence will be preserved, and who is responsible for investigating and communicating with affected customers.

4. Prepare a Breach Response Plan Before an Incident

The first few hours following a suspected breach can be critical.

Without a documented response plan, teams may spend valuable time deciding who should investigate, who has authority to escalate the incident, and which regulatory deadlines apply.

A practical breach response plan should identify:

• The incident response lead and escalation contacts.
• The process for containing the incident and preserving evidence.
• The teams responsible for legal, technical, operational, and communications decisions.
• Applicable regulatory reporting requirements and deadlines.
• The process for assessing the affected data and identifying impacted individuals.
• The procedure for notifying customers when required.

Businesses should test this plan through tabletop exercises rather than assuming that a written document alone guarantees readiness.

Understanding India's Data Breach Reporting Requirements

Indian businesses must consider multiple legal and regulatory obligations when responding to a cybersecurity incident.

The CERT-In Directions issued on 28 April 2022 require covered entities to report specified cyber incidents within six hours of noticing them or being brought to notice of them. The directions also establish requirements relating to incident records and other cybersecurity practices.

Regulated financial institutions may have additional reporting obligations under applicable RBI requirements. Listed companies must separately assess their disclosure obligations under SEBI's Listing Obligations and Disclosure Requirements framework.

These requirements serve different purposes. Reporting an incident to a regulator or stock exchange does not automatically mean that affected customers have been adequately informed.

Businesses should therefore maintain a compliance matrix identifying the rules that apply to their operations, the relevant reporting triggers, the responsible decision-makers, and the evidence required to demonstrate compliance.

Preparing for the DPDP Act's Breach Notification Requirements

The Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, introduce an important framework for personal data protection in India.

Under Section 8(6) of the Act and Rule 7 of the Rules, Data Fiduciaries will be required to notify the Data Protection Board of India and affected individuals about personal data breaches in accordance with the prescribed process.

The framework provides for an initial intimation to the Board without delay, followed by more detailed information within 72 hours, subject to the prescribed provisions. Affected individuals must also be informed without delay.

The relevant provisions are scheduled to commence 18 months after the Rules' November 2025 notification, in May 2027. Businesses should verify the applicable commencement date and requirements against the official notifications and obtain appropriate legal advice.

Organisations should not wait until these provisions commence to establish their breach response procedures. Building the necessary processes in advance can help reduce operational disruption and make future compliance more manageable.

Six Practical Steps Businesses Can Take Today

Indian businesses can improve their breach readiness by focusing on six practical priorities:

1. Map personal data. Document what information is collected, where it is stored, who can access it, and why it is retained.

2. Review vendors. Maintain a current register of third parties that process personal information and assess their security and contractual arrangements.

3. Establish a response runbook. Assign responsibilities for detection, containment, investigation, regulatory reporting, and customer communication.

4. Prepare notification templates. Draft clear customer communications explaining what happened, what information may be affected, and what protective actions individuals should take.

5. Conduct incident simulations. Test how teams respond to scenarios involving exposed files, compromised employee accounts, or a third-party security incident.

6. Maintain evidence. Record discovery times, investigation findings, containment actions, decisions, and notifications so that the organisation can reconstruct events accurately.

These measures are useful for businesses of all sizes. A small organisation may not have a dedicated security operations centre, but it can still maintain a data inventory, restrict access, document escalation contacts, and prepare a basic incident response plan.

Common Mistakes to Avoid After a Data Breach

Some response failures can make an already serious incident more difficult to manage.

One common mistake is assuming that a regulatory filing or stock exchange announcement replaces direct communication with affected customers where such communication is required.

Another is delaying action until the investigation is complete. Organisations should distinguish between confirming the full scope of an incident and taking immediate steps to contain a threat, preserve evidence, and assess their obligations.

Businesses should also avoid assuming that a small number of affected records makes an incident unimportant. Even a limited exposure can create significant risks if the information is sensitive or can be combined with other datasets.

Finally, organisations should not rely entirely on vendors to identify problems. Third-party alerts and external threat intelligence can be valuable, but businesses remain responsible for understanding their own exposure and responding appropriately.

How Compliance Technology Can Help

Managing data inventories, vendor relationships, reporting deadlines, and incident documentation across spreadsheets and email can become difficult as an organisation grows.

Compliance technology can help bring these activities into a more structured workflow.

For example, platforms such as RuleExpert offer capabilities for breach management, vendor governance, and data registry management. These tools can support incident documentation, help organisations track relevant information, and improve visibility into where personal data is held and which third parties handle it.

Technology alone cannot prevent every breach or replace legal advice, security expertise, and sound management decisions. Its value lies in helping teams organise information, assign responsibilities, and follow documented procedures when a problem occurs.

Conclusion

The SBI data breach investigation highlights a challenge that extends well beyond the banking sector. Organisations that collect customer information must be ready to protect it, detect potential exposure, and respond in a structured and timely manner.

Effective data protection requires more than technical safeguards. It depends on knowing where information resides, controlling access, managing third-party risks, preserving evidence, and understanding the reporting obligations that apply.

For Indian businesses, the most valuable step is to begin preparing before an incident occurs. A clear data inventory, a tested response plan, and a reliable vendor management process can make the difference between a controlled response and a prolonged crisis.

The lesson is straightforward: data breach readiness should be part of everyday business operations, not a project that begins only after customer information appears on the dark web.