Bank of Baroda confirms data breach, ’employee’s email account was compromised’

“The incident involved compromise of an employee’s email account, resulting in unauthorised access to certain data. The matter was promptly identified, and immediate containment measures were implemented. The Bank’s core banking systems were not accessed and continue to remain secure.” the company said in a statement.

The bank has confirmed that a comprehensive forensic investigation has been initiated, and is working closely with the relevant authorities in accordance with applicable regulatory requirements.

“The Bank remains committed to maintaining the highest standards of information security and to safeguarding the trust of its customers and stakeholders.” it added

Over 1TB data leaked?

The Triple X ransomware group claimed to have exfiltrated 1 TB of data from India’s second-largest public sector bank. The full dump is publicly accessible, with over 92,000 files observed across 9783 directories, including customer KYC, security reports, and internal audit documents. 

The data comes from what appears to be Bank of Baroda’s internal SharePoint / file-sharing system — not directly from the core banking database (Finacle), but enough to cause serious harm.

A post by Dark Web Intelligence said the threat actor claimed that the data covers savings and current accounts, loans, NetBanking users, NRI and corporate banking services, customer support, and branch or ATM-related records.

The details were also accessed by software engineer Srikanth Lakshmanan who shared some of the sample documents on X. The founder of CashlessConsumer also confirmed that the link was live. He added that the data went beyond standard KYC documents with “tonnes of internal audit data available”.

Screenshots shared by Lakshmanan included account opening forms with names, photo, UID  and other details. Copies of loan appraisal documents, vigilance handbooks and audit data were also available.

Claims highlighted by the software engineer suggest “weak password” was the key access vector for this hack. The files included data from approximately five years with a full recursive directory listing live on Tor. The Onion Router is a free, open-source network and specialized web browser used for anonymous communication.

How did the breach happen?

According to Triple X’s announcement, the breach was enabled by a “weak password”. The attackers likely gained initial access through compromised credentials. They then moved laterally through Bank of Baroda’s internal networ and reached the SharePoint / file server infrastructure. The hackers then exfiltrated approximately 1 TB of documents over an extended period and published everything publicly