Bank of Baroda is investigating an alleged data breach after nearly a terabyte of data reportedly surfaced on the dark web — an incident that underscores the cybersecurity risks facing India’s banking and fintech sector.
Cybersecurity researcher Srikanth Lakshmanan, founder of the consumer advocacy platform Cashless Consumer, first identified the dataset listed on a dark web site over the weekend.
The alleged leak reportedly includes customer identity documents, loan application and appraisal records, internal audit reports, branch documents, customer application forms and internal communications — the kind of operational data that increasingly sits at the intersection of banking and third-party fintech integrations.
Some reports have also claimed the dataset includes Aadhaar numbers and account records tied to savings, current and loan accounts, as well as NRI and corporate banking customers, though these details remain unverified.
Researchers have suggested a possible link to a threat actor known as TripleX, previously tied to attacks on Indonesian financial institutions, though the connection is unconfirmed.
Bank of Baroda attributed the incident to the compromise of an employee’s email account rather than any breach of its core banking infrastructure — a reminder that email remains a common entry point for attackers even at large, well-resourced institutions.
“The bank’s core banking systems were not accessed and continue to remain secure,” the bank said, confirming a comprehensive forensic investigation had begun.
The incident is likely to sharpen scrutiny of vendor and employee-account security practices across India’s banking and fintech ecosystem, where startups increasingly integrate directly with bank systems and data.
Data breaches involving Indian financial institutions have drawn increasing regulatory attention in recent years, with lenders required to report significant cybersecurity incidents to sector regulators within stipulated timeframes.
Bank of Baroda is one of India’s largest public sector banks, with a network spanning thousands of branches across the country as well as international operations in several countries.
(Image: Photo by Raghavan2010, Wikimedia Commons, CC BY-SA 4.0)