People entrust banks with their hard-earned money and their most sensitive personal information. When that information reportedly surfaces on the dark web, the issue goes far beyond a technical lapse: it strikes at the very foundation of public trust. Reports of a suspected data breach involving the State Bank of India (SBI), India’s largest public sector bank, raise an uncomfortable question: if a bank entrusted with safeguarding citizens’ savings cannot adequately protect their personal data, who will be held accountable? In an age when digital banking is celebrated as a symbol of progress, security cannot remain an afterthought.

According to media reports, around 3.75 lakh records associated with SBI surfaced on the dark web, while a preliminary examination reportedly identified personal information relating to 3,897 customers. The information was said to include names, telephone numbers, dates of birth, addresses, email details, customer identification numbers and loan-related records. However, the precise source of the data, the extent of the breach and the possibility of compromise within SBI’s own systems require independent verification. There is, as yet, no established basis for claiming that account passwords, one-time passwords (OTPs) or customers’ money were compromised. Such distinctions matter. But uncertainty about the scale of a breach must not become an excuse for institutional complacency.

SBI is not the only bank to have faced allegations concerning exposed customer information. Bank of Baroda has also figured in reports of a suspected data leak. These cases, however, must be distinguished from confirmed breaches; a technical disruption, such as an interruption in banking services, does not by itself establish that customer data have been stolen. The authorities must establish the facts rather than allow speculation to substitute for evidence. Equally, banks must not exploit the absence of conclusive findings to evade scrutiny.

The larger concern is the glaring imbalance between the power banks exercise over customer information and the accountability they accept when its security is questioned. Banks routinely collect identity documents, contact details, financial histories and loan records, often leaving customers with little practical choice but to disclose them. That privilege carries a corresponding obligation. A reassuring statement that normal banking operations remain unaffected does not answer whether personal information has been exposed, who accessed it or what safeguards failed. Protecting institutional reputation cannot take precedence over informing customers of risks to their privacy.

The consequences can extend well beyond the initial exposure. Criminals armed with genuine personal details can impersonate bank officials, fabricate convincing messages and frighten customers with threats of account suspension or demands for KYC updates. Such targeted fraud is more difficult to detect because the caller may possess information that appears to establish authenticity. Elderly customers and those unfamiliar with sophisticated digital scams may be particularly vulnerable. Customers must never disclose OTPs, PINs or passwords, should scrutinise account transactions and report suspected financial fraud immediately to their bank and India’s cybercrime helpline, 1930.

Yet placing the burden of vigilance entirely on customers would be an abdication of institutional responsibility. The Reserve Bank of India (RBI) and the government must demand independent cybersecurity audits, tighter controls over access to sensitive information and rigorous oversight of third-party service providers. Banks should promptly notify affected customers when a breach is established, explain the nature and likely consequences of the exposure, and provide practical assistance against fraud. Investigations must identify the source of the leak, the failures that enabled it and the officials or contractors responsible. Where negligence is proved, penalties must be meaningful enough to deter repetition. Compensation mechanisms for customers who suffer demonstrable losses should also be clear and accessible.

Digital banking cannot be judged by the speed of transactions, the expansion of mobile applications or the number of customers brought online. Its credibility rests on whether citizens can use these services without being exposed to avoidable risks. Public sector banks, in particular, owe citizens more than assurances: they owe them transparency, competence and accountability. A data breach must not become another episode in which institutions issue carefully worded statements while customers are left to manage the consequences. The test of a modern banking system is not merely how efficiently it moves money, but how rigorously it protects the people who entrust it with their money and their identities.