A major cybersecurity incident has come under scrutiny after Bank of Baroda confirmed that an employee’s email account was compromised, following reports that nearly 1TB of banking data had been exposed online. The bank clarified that its core banking systems were not affected and remain secure, while a detailed forensic investigation is underway in coordination with the relevant authorities.
According to reports, a threat actor allegedly released around 1TB of sensitive data on the dark web. The leaked information is said to include customer and corporate banking records, Aadhaar numbers, names, account details, loan information, NetBanking user data, NRI and corporate banking records, customer support material, and branch and ATM-related documents. Sample files were also reportedly shared online.
In its official statement, the bank said, “The incident involved compromise of an employee’s email account, resulting in unauthorised access to certain data. The matter was promptly identified, and immediate containment measures were implemented. The Bank’s core banking systems were not accessed and continue to remain secure.” It also added that a “comprehensive forensic investigation” is in progress.
The reported breach was first identified on July 25 by a dark web tracking platform. A cybersecurity expert who reviewed the sample files stated that they contained internal bank documents, including branch audit reports, loan appraisal records, internal communications, vigilance investigations, bobWorld audit reports, and customer application forms from multiple Bank of Baroda branches.
While no group has officially claimed responsibility, the expert suggested that a relatively new hacking group known as TripleX could be linked to the incident. The same group was reportedly involved in a cyberattack on an Indonesian state-owned bank earlier this year, where around 2TB of data was allegedly stolen.
The incident comes amid rising concerns over cybersecurity risks in the banking sector. It also follows a 2025 case in which a cybersecurity company reported that an exposed third-party cloud database contained more than 273,000 Indian banking records, including around 6,000 linked to Bank of Baroda.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream LinkedIn | The Mainstream Facebook | The Mainstream Youtube | The Mainstream Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.