Bank of Baroda investigates alleged dark web data breach

Bank of Baroda has launched an investigation into an alleged data breach after close to a terabyte of data reportedly surfaced on the dark web.

The dataset was first identified by cybersecurity researcher Srikanth Lakshmanan, founder of the consumer advocacy platform Cashless Consumer, who found it listed on a dark web site over the weekend.

The alleged leak is said to include customer identity documents, loan application and appraisal records, internal audit reports, branch documents, customer application forms and internal communications.

Additional unverified reports claim the dataset also contains Aadhaar numbers and account details tied to savings, current and loan accounts, along with information on NRI and corporate banking customers.

Some researchers have connected the breach to a threat actor known as TripleX, previously linked to attacks on Indonesian financial institutions, although this remains unconfirmed.

Bank of Baroda said the incident was traced to the compromise of an employee’s email account rather than any breach of its core banking systems.

“The bank’s core banking systems were not accessed and continue to remain secure,” the bank said, confirming that a comprehensive forensic investigation was underway.

The lender said it was coordinating with relevant authorities as the probe into the alleged breach’s scope continues.

Shares of Bank of Baroda dropped 1.50 per cent to Rs 240.35 on the NSE on July 28, with the alleged breach adding to pressure from the lender’s weaker first-quarter FY27 earnings.

The bank said immediate containment measures were put in place as soon as the breach was detected, and that it was complying with all applicable regulatory requirements during the investigation.

Bank of Baroda is one of India’s largest public sector banks, with a network spanning thousands of branches across the country as well as international operations in several countries.

Data breaches involving Indian financial institutions have drawn increasing regulatory attention in recent years, with lenders required to report significant cybersecurity incidents to sector regulators within stipulated timeframes.

(Image: Photo by Raghavan2010, Wikimedia Commons, CC BY-SA 4.0)