The dark web has emerged as the marketplace of financial cybercrime. Analyse the threats it poses to India's digital public infrastructure and banking customers.

The dark web is the hidden layer of the internet that search engines do not index. It now works as a "central hub for financial cybercrime", where stolen data are aggregated, repackaged and sold [1]. In October 2026, SBI disclosed that 3,897 customer records containing PII were found among about 3,75,000 records on the dark web [1]. The case shows a threat at two levels: to the whole system and to individual customers.

Leak/breach → bundled into verified "dumps" → bulk sale (~$50)
      → phishing / account takeover → customer loss → loss of trust in the system

Fig: How the dark-web marketplace turns stolen data into fraud

Threats to digital public infrastructure

• National-security angle: The Defence Cyber Agency and CERT-In both alerted SBI [1]. This shows that banking data is treated as critical infrastructure.
• Attribution gap: The alleged seller, "Siriusim", is only an alias, and its origin is unknown [1]. This weakens deterrence and response.
• Fragmented response: SBI disclosed the breach only under SEBI norms [1]. The DPDP Rules, 2025 are being phased in over 18 months [2]. As a result, the duty to notify affected people is not yet fully in force.
• Trust deficit: UPI and Aadhaar-linked services depend on public confidence. A leak at India's largest bank can slow digital adoption.

Threats to banking customers

• Cheap attacks: Data dumps sell for as little as $50 [1], so the cost of starting a fraud is very low.
• Targeted social engineering: A caller who knows a customer's real name and account details sounds like a genuine bank official. The aim is to extract an OTP or PIN.
• Liability trap: Under the RBI's 2017 circular, a customer has zero liability for a third-party breach reported within 3 working days [3]. But losses caused by sharing credentials fall on the customer until they report it [3]. The leak happens at the bank, while the loss can land on the customer.
• Information gap: SBI informed the stock exchanges five days after the first alerts [1]. Individual notice to the affected customers has not been confirmed.
• Most vulnerable: Elderly, rural and first-time digital users are the likeliest victims.

These two sets of threats feed each other: frauds against individuals add up to a loss of trust in the whole system. The way forward has four parts:

• Banks should notify affected customers using the breach-notice format in the DPDP Rules [2].
• The Data Protection Board should inquire into breaches, backed by penalties of up to ₹200 crore [2].
• RBI should treat fraud enabled by leaked data as a third-party breach.
• Banks should send one common breach report to SEBI, RBI and the Board.

Grounded in the Puttaswamy (2017) right to privacy, these steps can keep public trust as the foundation of India's digital public infrastructure.