Data breaches in public sector banks expose gaps in India's financial cyber-resilience architecture. Discuss with reference to recent incidents and suggest institutional reforms.

In October 2026, State Bank of India, India's largest commercial bank, disclosed that 3,897 customer records containing Personally Identifiable Information (PII) had surfaced on the dark web [1]. The episode shows that India detects financial breaches well but responds to them poorly.

What worked

• Multi-layered detection: alerts came from a private threat-intelligence provider, the Defence Cyber Agency and CERT-In [1]. This signals that banking data is treated as critical infrastructure.
• Verification before alarm: preliminary analysis narrowed about 3,75,000 leaked records to 3,897 with PII [1]. This avoided an inflated scare.

Gaps exposed

• Investor-first disclosure: SBI informed the stock exchanges under SEBI norms five days after the alerts [1]. Nothing shows that affected customers were told individually.
• Legal lag: the DPDP Rules, 2025 require plain-language breach notice to affected persons, but compliance is phased over 18 months [2]. So the duty may not yet fully bind banks.
• Cheap weaponisation: stolen data dumps sell for as little as $50 [1], which enables phishing from day one.
• Liability trap: RBI's 2017 circular gives zero liability for third-party breaches reported within 3 working days [3]. But losses from sharing an OTP fall on the customer, and that is exactly the fraud leaked PII enables. Elderly and first-time digital users are most exposed.
• Fragmented oversight: SEBI, RBI, CERT-In and the Data Protection Board each run separate reporting regimes.

Institutional reforms

• Single breach report: one filing to all four bodies, which also triggers customer notice in the same step.
• Early voluntary notice: banks should adopt the DPDP Rules' notice format now [2].
• Recalibrated liability: RBI should presume third-party fault where fraud uses data from a known leak, since the bank already bears the burden of proof [3].
• Credible deterrence: a Data Protection Board inquiry, backed by penalties of up to ₹200 crore for failing to notify a breach [2].
• Customer awareness: link breach alerts to the 1930 cyber-fraud helpline.

The SBI case shows that detection has outpaced response. A unified, customer-first breach regime would turn the Puttaswamy (2017) right to privacy into practical security. It would also sustain trust in digital banking, in line with SDG 16's call for accountable institutions.