The recent cyberattack incident at Bank of Baroda has prompted banks to heighten vigilance and put in place preventive measures. They are upgrading systems to combat cyberattacks, system outages, data breaches, third-party vulnerabilities and emerging AI threats.
A senior official at a large public sector bank said the recent incident is a cause for concern. “To avoid such risks, we have disabled Webex storage access, and files can now be accessed only through authorised office systems.”
But gaps remain. “While organisations have strengthened threat detection and identity controls, many still struggle to consistently govern sensitive data once it moves across employees, third-party providers, cloud platforms and AI tools,” said Vishal Gauri, CEO of Seclore.
The BoB incident a week back saw nearly 1 TB of customer and corporate data allegedly being leaked on the dark web. The breach originated from an employee’s email account, which resulted in unauthorised access. This marked the bank’s second cybersecurity incident in three years.
In June, the Reserve Bank of India (RBI) proposed a new framework for the use of AI. The RBI urged banks to put in place proper governance, risk management, and controls, along with continuous oversight. The regulator also proposed broad principles to manage risks from third-party models.
“More new services are being provided to customers. Therefore, the IT infrastructure is never stable, it constantly undergoes change, and it is bound to be vulnerable. Now, the major concern is Mythos, which has accelerated velocity of cybercrimes,” Munjal Kamdar, partner, Deloitte India, said.
The shortage of skilled technology professionals is an issue. “India faces a severe shortage of cybersecurity talent. As Frontier AI security models such as “Mythos” accelerate vulnerability exploitation, defence must also leverage AI — making a sovereign AI model increasingly important,” Kamdar said.
According to data shared in the Rajya Sabha on Friday, CERT-In detected 349,000 incidents involving malicious scanning and probing and vulnerable services in the financial sector during January–June 2026. This figure stood at 570,000 in 2025.
Vivek Iyer, partner and financial services risk leader, Grant Thornton Bharat, said lenders are reassessing potential cyber-threats more frequently now than they used to do earlier. This is important since cybercriminals are innovating faster than banks, he said.