TL;DR: Of the 1200+ companies that submitted their Business Responsibility and Sustainability Reporting (BRSR) disclosures for 2024-25, 29 reported at least one data breach, totalling 51 such instances. The remaining reported no such incident. Two companies accounted for 16 of the 51 breaches. Between 2023-24 and 2024-25, reported data breach instances rose from 41 to 44, an increase of three. These figures only reflect company disclosures, not all data breaches in India or the number of customers affected.

Context

On 21 October 2026, the State Bank of India (SBI) disclosed to stock exchanges an incident involving the loss of certain data. According to its announcement, a preliminary analysis of approximately 3.75 lakh records suspected to have been exposed on the dark web identified 3,897 customer records containing personally identifiable information.

SBI said it received alerts on 16 October 2026 and engaged an independent cybersecurity agency to investigate. It said further investigation was needed to establish the authenticity and completeness of the data, its source and the extent of exposure. It also said its core operations continued normally. These statements describe the position in its October 2026 disclosure, not a completed investigation.

The incident raises a broader question: what do companies’ public disclosures reveal about data breaches? The BRSR disclosures provide information on reported incidents and the percentage involving customers’ personal information. They offer a way to examine corporate reporting, although it cannot establish the full extent of breaches across India.

Who Compiles This Data?
The figures originate in companies’ BRSR disclosures filed with stock exchanges under the reporting framework introduced by the Securities and Exchange Board of India (SEBI).

Where can I download Clean & Structured Data on Data Breaches?

The company-wise dataset, including reporting periods, business activities, sectors, breach counts and customer personal information indicators, is available on Dataful.

Key Insights

29 of 1200+ Companies Reported at Least One Data Breach in 2024-25

Of the 1200+ companies that made BRSR disclosures, 1228 reported zero instances of data breaches and 29 reported at least one such breach. In other words, about 2.3%, or roughly two in every 100 companies that made these disclosures reported a breach.

The 29 companies together reported 51 instances of data breaches. 21 of the 29 companies reported exactly one instance, while two companies (nine and seven instances respectively) accounted for 16 of the 51, or about 31% of these breaches. The top four companies in terms of breach incidents accounted for 22 instances, or 43%.

The large number of reported zeros needs careful interpretation. It shows what companies reported under this indicator. It does not establish that their systems were completely secure, or that no undetected or unreported incident occurred. The data alone cannot determine whether differences between companies reflect exposure, detection capability or interpretation of the reporting requirement.

Reported Instances Increased from 41 to 44 Among Companies Covered in Both Years

Among the 1,088 companies with BRSR disclosures in both 2023-24 and 2024-25, reported instances increased from 41 in 2023-24 to 44 in 2024-25, an increase of three, or 7.3%. The number of companies reporting at least one data breach instance rose from 23 to 24.

The 44 instances mentioned here and the 51 instances noted previously are not conflicting figures. They refer to different samples: 1,257 companies in 2024-25 for the first, and 1,088 companies with disclosures in both years.

While the change is small in absolute terms, it does not establish whether the number of affected customers increased, whether incidents became more severe, or whether breaches increased across India.

Breach Counts Do Not Establish How Many Customers Were Affected

A breach count records incidents, rather than people. One incident affecting a small set of records and another involving a much larger customer base may each contribute one instance to a company’s total. The count alone cannot distinguish their scale or consequences.

The percentage of breaches involving customers’ personally identifiable information addresses a different question. It describes the share of reported incidents involving such information. A value of 100%, for example, would mean all reported breaches involved customer personal information. It would not mean all customers were affected. In 2024-25, only six of the 1,256 companies reporting a percentage gave a value above zero.

SBI’s disclosure illustrates another distinction: records and individual customers are not interchangeable. A record count does not, by itself, establish the number of unique people affected.

Understanding customer exposure requires further information, including what data was involved, how many individuals were affected and what action followed. The charts provide a picture of reported incidence, while leaving those questions unanswered.

Why Does It Matter? 

Corporate disclosures are a starting point for understanding how companies report data breaches. In the 2024-25 BRSR disclosures data, 29 companies reported 51 instances, and a few companies accounted for a large share of them.

These figures need to be read alongside their limits. A reported zero is not an independent security assessment, and an incident count does not show how many customers were exposed. The SBI disclosure shows why the distinctions between incidents, records and affected individuals matter when reading a breach headline.

For customers, the practical questions go beyond how many incidents a company reported. The type of information involved, the scale of exposure and the company’s response are needed to understand what an incident could mean for them.

Key Numbers

• Companies with BRSR Disclosures in 2024-25 with a section on Data Breaches: 1,257

• Companies reporting zero instances: 1,228

• Companies reporting at least one instance: 29 (2.3% of the sample)

• Total reported instances in 2024-25: 51

• Share of instances from the top two reporting companies: about 31% (16 of 51)

• Companies with BRSR Disclosures in both 2023-24 and 2024-25: 1,088

• Reported instances of Data Breaches in the above sample: 41 (2023-24) → 44 (2024-25), +7.3%

• Companies reporting at least one instance in both years: 23 → 24

• Companies reporting a PII leak share above zero, 2024-25: 6

Methodology note: The analysis uses BRSR disclosures made by companies for the April to March Periods. Companies reporting for other periods are excluded. Missing values are not treated as zeros. The matched comparison uses companies with numerical counts in both 2023-24 and 2024-25. Figures are drawn from Dataful’s compilation and have not been independently verified against individual company reports. Dataful’s methodology flags possible discrepancies between company PDF and XML submissions. The dataset is not a census of breaches in India.