Bank of Baroda data breach: How to check if your personal details were leaked

The breach raised concerns among millions of customers who now want to know whether their personal information forms part of the leaked data. A breach-checking portal has been made available by cybersecurity researcher and CashlessConsumer founder Pankaj Kumar. Customers can use it to search whether information linked to them appears in the leaked dataset.

How can Bank of Baroda customers check if they were affected?

Customers who want to know whether their Bank of Baroda branch appears in the leaked dataset can use the online branch checker developed by fintech researcher Srikanth Lakshmanan through CashlessConsumer. The tool analyses the directory structure of the leaked files and matches it with Bank of Baroda branch information.

Step 1: Find your Bank of Baroda IFSC code

The first step is to locate your branch’s IFSC code. Customers can find it on their cheque book, where it appears on every cheque leaf alongside the branch name. The code is also available on the first page of the bank passbook, on printed or downloaded account statements, and in the account details section of Bank of Baroda’s internet banking portal or the Bob World mobile application.

Customers who have made NEFT or RTGS transfers earlier can also find the IFSC code on transaction receipts.

According to CashlessConsumer, every Bank of Baroda IFSC code begins with BARB0. The last character is the number zero, not the alphabet O.

Step 2: Visit the branch checker

After locating the IFSC code, open a web browser and visit the website.

CashlessConsumer says the tool compares the leaked directory structure with the Razorpay IFSC database, which contains thousands of active Bank of Baroda branch codes. The website only requires a branch identifier and does not ask customers to enter account numbers, debit card details or other banking credentials.

Step 3: Search for your branch

The portal offers three ways to search. The quickest method is to enter the complete IFSC code of your branch in the search box. This gives the most precise result because it directly checks whether files linked to that branch appear in the leaked dataset.

Customers who do not know their IFSC code can instead search by entering the name of their city. The portal then displays Bank of Baroda branches from that city that appear in the dataset.

Another option is to search using the branch name or the name of the state. This option may help customers who maintain accounts at multiple branches or want to check branches in different locations.

Step 4: Understand the result

Once the search is complete, the tool displays one of two results.

If the result shows “EXPOSED”, it means files linked to that branch were identified in the leaked data. CashlessConsumer says the level of risk depends on the type of documents associated with the branch. Some records may contain customer KYC information and personally identifiable information, while others may consist of operational or internal documents.

An “EXPOSED” result does not automatically mean that every customer of that branch has had personal information leaked. It indicates that documents connected to that branch formed part of the publicly available dataset.

If the result displays “NOT FOUND”, it means the investigation did not identify files linked to that branch in the available directory listing.

Step 5: Know what the result actually means

CashlessConsumer says customers should interpret the results carefully.

The branch checker relies on metadata, directory names and file paths that were visible in the leaked data. It does not analyse the contents of every document in the dataset.

Because of this limitation, an “EXPOSED” result confirms that the branch appears in the leaked directory structure. However, a “NOT FOUND” result should not be treated as confirmation that no customer information was affected, since some files may not contain identifiable branch references.

The investigation says the leaked dataset includes customer eKYC files, customer KYC records, ReKYC-related documents and DBT BSBD records. The files may contain Aadhaar details, PAN information, photographs and address documents. The dataset also reportedly includes internal security assessment reports and vulnerability documents related to several banking systems.

Step 6: Take precautions immediately

CashlessConsumer advises all Bank of Baroda customers to strengthen their account security regardless of the search result.

Customers should enable SMS and email alerts for all transactions so that any unauthorised activity can be detected quickly. They should also change their internet banking password and create a strong password that is not used for any other online account.

The investigation also recommends enabling two-factor authentication, updating the MPIN of the Bob World mobile application, reviewing recent account activity for suspicious transactions and regularly monitoring their credit history for signs of identity theft.

Step 7: Stay alert for fraud attempts

CashlessConsumer says the leaked information could make several types of fraud easier.

Customers should be cautious of calls, emails and text messages claiming to come from Bank of Baroda. Fraudsters may use leaked personal information to convince victims that they are genuine bank representatives. Customers should never share OTPs, passwords or debit card details over phone calls or messages.

The investigation also warns about possible loan fraud, where criminals may attempt to misuse leaked KYC documents to obtain loans, and SIM swap attacks that could allow fraudsters to intercept banking OTPs. Customers should immediately contact their telecom provider if they notice unexpected SIM-related activity or a sudden loss of mobile network service.

Details of Bank of Baroda data breach

Bank of Baroda said the breach resulted from the compromise of an employee’s email account. The bank stated that it identified the incident quickly, contained it and confirmed that its core banking systems were not accessed.

The bank has launched a forensic investigation and said it is working with relevant authorities in line with regulatory requirements.

The alleged attackers, identified as the Triple X ransomware group, claimed they stole around 1TB of data. Cybersecurity researchers who reviewed portions of the leaked files said they found customer KYC documents, account opening forms, loan appraisal papers, internal audit records, security reports and other internal documents.

Software engineer Srikanth Lakshmanan also examined samples of the leaked files and shared screenshots showing documents containing customer names, photographs, Aadhaar-related information and banking records. CashlessConsumer founder Pankaj Kumar said the leak extends beyond customer KYC documents and includes large volumes of internal audit material.

Researchers believe attackers initially gained access using compromised employee credentials after exploiting what they described as a weak password. They then moved through the bank’s internal network before reaching its SharePoint and file-sharing infrastructure, from where they allegedly copied data over an extended period.