Regulators hear of a bank data breach within hours. Customers should not have to wait until 2027

On 16 October State Bank of India learnt, from its threat intelligence provider, the Defence Cyber Agency and CERT-In, that its customers’ data was being offered on the dark web. Within days it had told the stock exchanges. Its message to investors on 21 October was that there was “no material impact” on the bank’s operations or finances. It was only on Friday, a week after the alerts, that the bank said publicly it had personally informed the customers whose details had leaked.

That order of priorities tells us something about the rules, not just about SBI.

Who gets told, and when

A bank in India must report a cyber incident to the Reserve Bank within two to six hours of detecting it. Under CERT-In’s directions of April 2022, it must also report to the national cyber security agency within six hours. A listed bank must keep the stock exchanges informed. Every one of these duties runs towards the state or the market.

The person whose name, mobile number, date of birth and home address are now in a criminal’s spreadsheet has no such right. The Digital Personal Data Protection Act does require organisations to inform each affected person about a breach, but that duty applies only from 13 May 2027. An RBI advisory issued in March recommends that banks notify customers by SMS, email, app alerts and calls. It is advice, and nothing more.

Why it matters

The leaked SBI records are not passwords or balances, and the bank is right to say that funds are safe. But the details that did leak are exactly what a fraudster needs to sound like a bank official on the phone: a name, a branch, a loan application, a date of birth. The Internet Freedom Foundation made the point sharply when it noted that the filing to investors “does not say whether a single affected customer has been told”. A customer who has been warned can hang up on that call. One who has not is easy prey.

The scale is also uncertain. SBI has identified 3,897 records with personal details out of the roughly 3.75 lakh rows it examined. The person who posted the data claims to hold 2,722 PDF documents as well, including loan and account opening forms. SBI has not yet said how the data left the bank, or how old it is.

The fair objection

Banks will argue that telling customers too early does harm. A leak claim on a hacking forum may be false or recycled. Mass alerts sent before the facts are known can cause panic and invite a new wave of fake “your account is at risk” messages. An investigation takes time.

That is reasonable, up to a point. It argues for a short, defined window after a bank confirms that specific customers’ data has leaked. It does not justify leaving customers to read about it in the newspaper, or to depend on the goodwill of each bank.

What should change

First, the RBI should turn its March advisory into a binding direction. Once a bank confirms that a customer’s personal data has been exposed, it should be required to tell that customer directly, in their language, within 72 hours.

Second, the notice should say what leaked, what the customer should watch for, and how to reach a dedicated helpline. A line advising people never to share OTPs is not enough.

Third, banks should publish, once their investigation ends, how the breach happened and what they have changed, and the RBI should report each year how many such incidents its regulated entities have notified.

Finally, any customer who loses money through fraud that uses leaked bank data should be compensated by the bank without having to prove the link.

SBI has now done what the advisory asks. The next bank may not. Customers’ safety should not depend on which bank they happen to use, or on a law that arrives in 2027.

The reporting behind this view

• 3,897SBI customer records found to contain personal details, out of about 3.75 lakh rows examined
• 6 hourstime within which banks must report cyber incidents to CERT-In, under 2022 directions
• 13 May 2027date from which the law requires affected people to be told of a breach