Nearly four thousand State Bank of India customers whose personal details surfaced on the dark web have not been told what happened to their data, according to the Internet Freedom Foundation. In a statement issued on October 21, the digital rights organisation said SBI's own disclosure to stock exchanges is conspicuously silent on whether a single affected customer has been informed, even as the bank moved quickly to reassure investors that its business remains unaffected.
A Gap Between Investor Reassurance and Customer Protection
SBI's exchange filing describes a textbook corporate response: a threat was flagged, incident response protocols were triggered, and the bank's core operations were declared unharmed. What it does not describe, IFF points out, is any communication to the 3,897 customers whose phone numbers, dates of birth, and home addresses are now believed to be in the hands of fraudsters. That distinction matters because these details are precisely what criminals use to sound credible. A caller who can recite your address and birth date back to you is far more convincing than one fishing blindly, and such information is routinely used to stage calls impersonating bank officials. IFF's underlying argument is simple: a customer cannot protect herself from a fraud she has not been warned about. Five days separated the initial alert to SBI from its public filing, a gap during which, as far as the record shows, no customer notification went out.
What IFF Is Demanding
The organisation has laid out a five-point charter directed at both the bank and its regulators.
- Direct notification to every affected customer through SMS, email and letter, in English, Hindi and the relevant regional language, along with a dedicated helpline and an online tool to check exposure.
- Full disclosure of scale and content: what the reported 3.75 lakh records and 2,722 documents actually contain, the precise number of customers affected, and whether sensitive KYC documents such as Aadhaar, PAN or passport details were part of the leak.
- A public explanation, once the investigation concludes, of how the breach occurred, including any role played by vendors or direct selling agents, along with a published summary of the investigating agency's findings.
- A firm deadline set by the Reserve Bank of India requiring all regulated entities to notify customers of data breaches, pending full enforcement of the Digital Personal Data Protection Act.
- Immediate enforcement by the Ministry of Electronics and Information Technology of Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, the specific provisions governing breach notification.
Why the Regulatory Gap Matters
India's data protection law was passed in 2023, but its breach-notification machinery is not yet fully operational, leaving banks and other data handlers to decide largely on their own terms what, when and how much to disclose. In the interim, companies tend to prioritise securities-law obligations, which require prompt disclosure of material events to investors, over any comparable duty to individuals whose personal information has been compromised. That asymmetry is at the heart of IFF's complaint. Shareholders learned within days that the breach would not dent SBI's balance sheet; customers, so far, have learned nothing about whether their own information is being weaponised against them. As India's largest lender, with hundreds of millions of account holders, SBI's handling of this episode is likely to be read as a signal of how seriously regulated institutions will take individual notification once the DPDP framework is fully in force. Until then, IFF's demands amount to a test case for whether customer protection catches up with corporate disclosure, or continues trailing well behind it.