ON October 21, 2026, news regarding a data leak at the State Bank of India (SBI) came to light. A few days prior to this, reports emerged regarding unauthorised transactions associated with the RTGS system of the Central Bank of India between October 15 and 17. Months before that, in July 2026, a data security breach at the Bank of Baroda had also made news.

In the banking sector, which handles the deposits and personal information of millions of ordinary citizens across the country, data security is of paramount importance. The emergence of cybersecurity-related incidents, even in prominent public sector banks, raises serious concerns. The data leak report at the State Bank of India, the security breach at the Bank of Baroda, and the complaint regarding unauthorised transactions worth Rs 13.97 crore at the Central Bank of India raise grave questions about the security of the banking system.

These cannot be viewed merely as isolated technical issues. Internal controls of banks, staff availability, investment in technological infrastructure, the growing trend of relying on third-party agencies, and management accountability are all integral parts of this issue.

DATA LEAK AT SBI

According to reports that emerged, preliminary checks identified that out of approximately 3.75 million records found on the dark web, 3,897 records contained personal information related to SBI customers. These reportedly included names, registered mobile numbers, dates of birth, gender details, addresses, email addresses, branch details, Customer Information File (CIF) identification numbers, and details related to loan applications and customer leads.

While it is reassuring that customers' funds at SBI were not directly lost, the absence of direct financial loss does not diminish the gravity of the data leak. Fraudsters can utilise these personal details to pose as bank officials, send trustworthy-looking messages, and misuse identification information.

SECURITY CONCERNS AT BANK OF BARODA AND CENTRAL BANK

In July 2026, reports surfaced that unauthorised access to certain information had occurred at the Bank of Baroda following the compromise of an employee's email account. The bank confirmed the incident following reports of large volumes of bank-related data becoming available on the dark web. However, the volume and scope of the data claimed to have been leaked have not been independently verified. The bank stated that it had initiated a forensic investigation and that core banking systems remained unaffected.

At the Central Bank of India, a complaint arose that Rs 13.97 crore was diverted through 187 unauthorised transactions between October 15 and 17, 2026. Reports indicated that these transactions were linked to the bank's settlement account with the Reserve Bank of India. The bank's official clarification pointed to a technical glitch in the RTGS outward system and clarified that customers did not suffer any financial loss. Therefore, the exact financial impact and the technical causes of the reported incident need to be ascertained through an investigation. While it cannot be said that all these incidents are of the same nature or stemmed from the same cause, they collectively highlight the urgent need to further strengthen information security and transaction controls in major public sector banks.

CONTRACTUALISATION AND BANK ACCOUNTABILITY

The reliance of banking operations on outsourcing, third-party service providers, business correspondents, and fintech entities has been steadily increasing. While utilising technological services is not inherently wrong, ensuring their control and security becomes vital when customer data and critical bank operations are dispersed across multiple entities. Even when bank operations are entrusted to external agencies, the ultimate responsibility for their security and accountability rests with the bank management.

The issue concerning the cash shortage of Rs 8.06 lakh at Canara Bank's Palakkad Big Bazaar branch, and the manner in which bank authorities handled it, must also be examined alongside this. In an article published on August 13 regarding this incident, which reportedly occurred on June 5, 2026, questions were raised regarding the circumstances of the cash shortfall, the manner in which it was handled, and doubts surrounding its reporting as fraud. Following the publication of this article, an external agency named CloudSEK, claiming to represent the bank, demanded that the article be removed or that authentic internal bank documents forming the basis of the allegations be provided. The scenario where an external agency intervenes to demand documents instead of conducting a legitimate investigation to ascertain facts and ensure accountability regarding internal cash losses raises serious questions about the internal responsibility and transparency of banks.

STAFF SHORTAGES AND CYBERSECURITY

As digitalisation advances rapidly in the banking sector, equal importance must be given to recruiting adequate permanent staff and providing continuous training to existing employees. Technological systems alone cannot resolve all security issues. Trained personnel play a crucial role in identifying suspicious transactions, issuing warnings to customers, reporting technical flaws, examining complaints, and monitoring the functioning of security systems.

It is imperative to critically evaluate how outsourcing more functions to external agencies while reducing staff numbers under the guise of digitalisation impacts the internal security of banks. The official contract concerning computerisation in the Indian banking sector was signed on September 8, 1983. The Indian banking sector entered the computer age in the mid-1980s with the promise that human labour would be eased and banking operations would become more efficient. The changes that have taken place over four decades since then deserve to be examined.

In 1985, across 267 commercial banks in the country (28 public sector banks, 188 regional rural banks, and 51 private-foreign banks), there were 8.84 lakh employees. The total business handled by them was Rs 1.37 lakh crore. However, available figures indicate that in 2025–26, across 124 commercial banks (12 public sector banks, 21 private banks, 44 foreign banks, 28 regional rural banks, 11 small finance banks, 4 payment banks, and 4 local area banks), total business rose to Rs 492.03 lakh crore, and the workforce stood at 19.15 lakh employees. In other words, while an employee handled an average business of Rs 15.49 lakh in 1985, it increased to approximately Rs 25.69 crore by 2025-26. These figures represent a nominal comparison of monetary value and should not be viewed as a measure of real growth adjusted for inflation or individual employee productivity; nevertheless, they illustrate the massive expansion in the scope of banking operations.

Focusing solely on public sector banks, in 2025–26, a total business of Rs 283.29 lakh crore was handled by approximately 7.63 lakh employees. This means the average business handled per employee is roughly Rs 37.15 crore. In addition to this, bank employees shoulder additional responsibilities such as insurance, mutual funds, various government schemes, and election or census-related duties. Therefore, blaming employees alone for minor flaws in security systems is unjust. Technological infrastructure, human resources, internal controls, and management decisions must all be comprehensively reviewed. Employees must not be made scapegoats for systemic failures.

URGENT INTERVENTION NEEDED TO ENSURE SECURITY

To strengthen the cybersecurity of banks, independent and comprehensive investigations must be conducted to identify the source and extent of data leaks and unauthorised transactions. Regular security checks and audits of software, servers, databases, and third-party services must be institutionalised. Access to customer data must be strictly restricted, avoiding the collection and retention of unnecessary data. Along with strengthening monitoring mechanisms to detect suspicious transactions, affected customers must be notified in a timely manner, and grievances must be resolved swiftly.

Sufficient permanent staff must be recruited, and they must be provided with ongoing training in cybersecurity and digital banking. The Reserve Bank of India and relevant authorities must comprehensively evaluate the security systems and preparedness of banks. Employees and union representatives who point out irregularities must be guaranteed the opportunity to lodge complaints and bring facts to light through legitimate channels, avoiding any situation where they are subjected to retaliatory measures.

The security incidents at SBI, Bank of Baroda, and the Central Bank of India, along with the Canara Bank cash shortage issue and the intervention of external agencies, underscore the pressing need to strengthen banks' internal controls and accountability. While it cannot be argued that contractualisation is the sole cause of all these incidents, policies that lead to an over-reliance on external agencies for critical operations, staff shortages, and weak supervision must be corrected. Instead of replacing human resources with AI and other technological systems alone, a system where technology and trained personnel work complementarily must be ensured.

The responsibility of public sector banks, which handle the deposits and trust of millions of ordinary citizens, does not end with ensuring profit and business continuity; safeguarding customer funds and privacy is their fundamental duty as well. Technological progress in the banking sector should not be utilised merely to cut costs and shed personnel, but rather to enhance customer service and bolster security. A safe banking system can only be assured through adequate permanent staff, modern technological infrastructure, robust internal controls, transparent investigations, and responsible management. Public trust, employee participation, institutional transparency, and clear accountability are all equally indispensable to achieving this. 

CPI(M) MP Writes to FM over SBI Data Leak

CPI(M) MP S Venkatesan has written to Finance Minister Nirmala Sitharaman over the leak of data of State Bank of India (SBI) as well as unauthorised transactions of ₹13.97 crore at Central Bank of India. He called for an investigation under the supervision of a Parliamentary Standing Committee into the matters.

In a letter on October 23, he wrote: “I am shocked and deeply concerned to learn that approximately 3,75,000 records of State Bank of India (SBI) are available on the dark web. I am equally disturbed to know that 3,897 customer records were identified which included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs and metadata associated with loan/lead records and other related files.”

This incident has exposed that there is a serious security lapse. This is unprecedented and lays bare the vulnerability of the data protection capacity of the largest Bank, SBI with more than 50 crore customers.

He sought to know what were the immediate steps taken by SBI to reach out to the customers whose data have been leaked and to protect their interest.
He also asked what were the urgent measures taken by SBI to prevent further loss of data and what are the steps taken by SBI to completely protect the customers’ data in future.

He requested the finance minister to direct SBI to act swiftly in the interest of the general public and the customers who wholly depend upon public sector banks for their genuine banking needs and livelihood.

In a separate letter on October 25, he wrote it is really shocking to note that Central Bank of India has alleged that ₹13.97 crore has been siphoned from its RBI settlement account. It is quite surprising to learn the manner in which this fraud has happened.

The Central Bank of India has reported 187 unauthorised transactions totalling approximately ₹13.97 crore from its settlement account maintained with the Reserve Bank of India (RBI). The transfers allegedly took place over three days, from 15 to 17 October 2026, and the money was routed to accounts across 36 banks.
The bank alleges that the transactions involved unauthorised access to the central Structured Financial Messaging System (SFMS) infrastructure operated by Indian Financial Technology and Allied Services (IFTAS), a wholly owned RBI subsidiary. Mumbai's Nodal Cyber Police have registered a case against unknown persons.
He urged the government to institute an urgent forensic technical audit and forensic investigation under the supervision of the Parliamentary Standing Committee including the MPs from all the parties to go into all aspects of the data theft of SBI and Bank of Baroda, unauthorised access into the SFMS infrastructure of Central Bank of India operated by IFTAS, how they happened, insider involvement, fixing responsibility and accountability of the bank, system operator and other parties based on evidence, strengthening the fire walls, revisiting the outsourcing policy of the RBI and all the public sector banks in order to protect the interest of the crores of customers and the general public.