Bank of Baroda data leak: What we know so far about alleged cyber breach

Dubai: India's state-owned Bank of Baroda is investigating a cybersecurity incident after customer data and internal documents were found circulating on the dark web, raising fresh concerns over cyber risks facing the country's banking sector.

While early reports claimed as much as 1 terabyte of data had been leaked, the bank said its core banking systems were not compromised and attributed the breach to a compromised employee email account. A forensic investigation is under way, and the lender said it is working with relevant authorities after taking initial containment measures.

The incident first came to light over the weekend after cybersecurity researcher Srikanth Lakshmanan, founder of consumer advocacy platform Cashless Consumer, identified a dataset advertised on a dark web site.

According to Reuters, metadata associated with the leak suggested the cache contained more than 700GB of information, although some cybersecurity reports and online posts claimed the dataset could be as large as 1TB. The exact size has not been independently verified.

Lakshmanan said he was able to verify sample documents before alerting the bank and authorities. Reuters reported that a source familiar with the matter also confirmed customer data and internal documents had appeared online.

According to the researcher and media reports, the leaked files appear to include:

Some reports also claimed the dataset contained Aadhaar numbers, savings and current account records, NetBanking user information, NRI and corporate banking records, customer support material, and branch and ATM-related data. Those claims have not been independently verified by Reuters, and Bank of Baroda has not confirmed the specific contents of the leaked files.

Bank of Baroda said the incident resulted from the compromise of an employee's email account rather than its banking infrastructure.

"The bank's core banking systems were not accessed and continue to remain secure," it said.

The lender added that it has robust information security protocols, launched a forensic review and is coordinating with relevant authorities to determine the scope of the incident. It has not disclosed how many customers may have been affected.

No hacking group has publicly claimed responsibility.

Some cybersecurity researchers have linked the incident to a relatively new threat actor known as TripleX, which has previously been associated with attacks targeting financial institutions, including Indonesia's PT Bank Negara Indonesia earlier this year.

Bank of Baroda has not identified any group responsible, and investigators have not publicly attributed the breach.

The incident highlights the growing cyber risks facing financial institutions, even when core banking systems remain secure. Security experts note that employee email accounts can provide attackers with access to sensitive documents without breaching a bank's primary transaction systems.

The breach also follows several high-profile cyber incidents involving major Indian organisations in recent months, including Tata Electronics and files linked to India's largest nuclear power plant appearing on the dark web, underscoring the increasing sophistication of cyber threats targeting critical institutions.