The incident involved compromise of an employee's e-mail account, resulting in unauthorised access to certain data.
State-owned Bank of Baroda (BoB) has been hit by a cyberattack, with nearly 1 terabyte (1TB) of data, including consumer and corporate banking records of its customers, allegedly leaked on the dark web for free.
The alleged breach includes data related to customers' savings and current accounts, loan accounts, net banking users, non-resident Indians (NRIs) and corporate banking services, as well as branch and ATM-related records.
Key Points
- Bank of Baroda has launched a forensic investigation after an alleged cyberattack reportedly leaked nearly 1TB of banking data.
- The alleged leaked dataset includes customer account details, loan records, NRI banking information, corporate banking data and ATM records.
- The bank said only an employee's e-mail account was compromised, while core banking systems remained secure and unaffected.
- Reports linked hacking group TripleX to the alleged breach, though no hacker has officially claimed responsibility so far.
- The incident adds to a series of cyber and data security breaches previously reported across India's banking sector.
Employee E-mail Account Compromised
In a statement, the Mumbai-based lender said a comprehensive forensic investigation has been initiated and it is working closely with relevant authorities, in accordance with applicable regulatory requirements.
'The incident involved compromise of an employee's e-mail account, resulting in unauthorised access to certain data.
'The matter was promptly identified, and immediate containment measures were implemented.
'The bank's core banking systems were not accessed and continue to remain secure,' the bank said in a statement on Monday.
Core Banking Systems Remain Secure
'The bank has robust information security protocols in place,' it said, adding that it remains committed to maintaining the highest standards of information security and to safeguarding the trust of its customers and stakeholders.
No hacker has claimed responsibility for the data breach yet.
However, according to some reports, hacking group TripleX has claimed responsibility for publishing the data online.
Alleged Dark Web Data Leak
A listing on dark web monitoring platform Ransomware.live, dated July 24, alleges that the dataset includes between 100,000 and 300,000 customer application forms containing photographs and identity documents submitted during account opening.
In the past, several banks have been hit by data breaches.
Past Banking Data Breaches
Earlier this year, around 5,000 customers of Yes Bank's multi-currency prepaid forex card, issued in partnership with BookMyForex, were hit by a spate of fraudulent transactions in the early hours of February 24.
Transactions worth $280,000 were approved during the incident.
The bank, however, managed to decline 688 unauthorised transaction attempts, safeguarding around $100,000.
In 2024, ICICI Bank, India's second-largest private sector lender, admitted to a data glitch that affected nearly 17,000 newly-issued credit cards.
The cards were mistakenly linked to the wrong users on the bank's digital channels.
In October 2016, card data of 3.2 million customers was stolen between May 25 and July 10 from a network of Yes Bank ATMs managed by Hitachi Payment Services.
Malware targeted 90 Yes Bank ATMs and point-of-sale (PoS) terminals, resulting in the theft of customer data from banks, including State Bank of India, ICICI Bank, HDFC Bank and Yes Bank.
Of the affected cards, 2.6 million were reported to be on the Visa and Mastercard platforms and 600,000 on the RuPay platform.
The worst-hit card-issuing banks included SBI, HDFC Bank, ICICI Bank, Yes Bank and Axis Bank.
Feature Presentation: Ashish Narsale/Rediff
