Your Bank Says Personal Data Leaked. Do These Checks
Matthew Leo · Published October 23, 2026 · Guides
A bank-data breach can expose enough information for convincing scams without giving criminals direct access to a chequing account. The right response starts by finding out exactly what was involved.
That distinction is timely. On October 21, Reuters reported that State Bank of India was investigating records found on the dark web. A preliminary review matched personally identifiable information for 3,897 customers within a much larger collection of about 375,000 records. The matched data reportedly included names, contact details, identification information and loan data.
The bank said an independent cybersecurity firm was investigating. The source, authenticity and full scope were not yet established. That means the larger number should not be described as 375,000 confirmed bank victims.
For Canadians receiving any bank or company breach notice, the following sequence reduces risk without assuming the worst.
1. Verify the notice outside the message
Do not click the link or call the number in an unexpected email or text. Open the bank’s app yourself, type its official website address or call the number printed on your card. Ask whether the notice is genuine and which information was affected.
This matters because criminals reuse breach headlines in phishing messages. The Canadian Anti-Fraud Centre warns that impersonators create urgency and ask for passwords, verification codes or remote access. A legitimate bank should not need your one-time code to “secure” an account.
2. Match your response to the exposed data
If a password was exposed, change it immediately and change any other account that reused it. Use a unique password and turn on multifactor authentication where available.
If payment-card details were exposed, ask the issuer whether it will replace the card and monitor for unfamiliar transactions. If identity documents or a Social Insurance Number were involved, the risk is different: criminals may try to open new credit or impersonate you long after the original breach.
Do not replace every credential merely because a breach occurred. The organization’s notice should identify the information involved and the protective service, if any, being offered.
3. Turn on transaction and sign-in alerts
Enable notifications for card purchases, transfers, profile changes and new-device sign-ins. Review recent transactions and payees. Report anything unfamiliar through the bank’s official channel.
Canada’s Financial Consumer Agency explains the protections and responsibilities around unauthorized transactions. Reporting quickly gives the institution a chance to investigate and limit further activity.
4. Check both Canadian credit files
Order your reports directly from Equifax Canada and TransUnion Canada. Canada has two main credit bureaus, and a suspicious account may appear on one report before the other.
The Financial Consumer Agency’s guide explains how to check a credit report for errors and fraud. Look for inquiries, addresses and credit accounts you do not recognize. Mapletechie’s step-by-step guide to checking Canadian credit reports for unknown accounts can help you work through both files.
If the exposed information could be used to apply for credit, contact both bureaus about a fraud alert. A fraud alert asks lenders to take extra steps to verify an application; it is not the same as a universal credit freeze.
5. Keep a simple incident record
Save the breach notice, reference numbers, dates, disputed transactions and the names of organizations contacted. Take notes during calls. The Office of the Privacy Commissioner of Canada recommends keeping records of purchases, payments and the steps taken after identity theft.
The commissioner also publishes a practical guide for people who receive a privacy-breach notification.
6. Report actual fraud, not only exposure
If money was taken or an account was opened in your name, contact the financial institution and local police, then report the incident to the Canadian Anti-Fraud Centre. Follow the issuer’s instructions for compromised government identity documents.
A breach notice is a warning that information may be misused; it is not proof that fraud has already occurred. Verification, targeted credential changes, account alerts and two clean credit reports are more useful than panic. Repeat the checks over the following months because identity fraud can appear well after the initial disclosure.
Tags: data breach, banking, identity theft, fraud, Canada