Bank of Baroda investigates 1TB customer data leak
What's the story
Bank of Baroda is facing a major data breach crisis after a hacking group claimed to have leaked nearly 1TB of sensitive customer and internal banking data on the dark web. The group, known as TripleX, has claimed responsibility for the incident. The public sector lender has initiated a forensic investigation and is cooperating with relevant authorities following initial containment efforts. The breach stemmed from a compromised employee email account, leading to unauthorized access to certain data.
Data details
Allegedly leaked dataset contains sensitive customer information
The alleged data breach has drawn the attention of cybersecurity researchers.
The leaked dataset, according to a listing on dark web monitoring platform Ransomware.live dated July 24, contains between 100,000 and 300,000 customer application forms with photos and identity documents submitted during account opening.
It also allegedly includes Aadhaar details, savings and current account information, loan application records as well as NetBanking user details.
Confidential records
Alleged breach exposes confidential internal records
In addition to customer information, the alleged data breach has also exposed confidential internal records.
Srikanth Lakshmanan, a software engineer and founder of CashlessConsumer, said he reviewed sample files shared by the attackers.
He found branch audit reports, loan appraisal documents, vigilance investigation records, BoB World audit reports, and application forms from branches across India in these leaked files.
Past incidents
TripleX previously targeted Indonesia's Bank Negara Indonesia
Notably, this isn't the first time TripleX has targeted a financial institution.
The group had previously claimed to have stolen some 2TB of data from Indonesia's state-owned Bank Negara Indonesia in May this year.
However, despite these claims, the authenticity of the leaked data remains unverified as no official confirmation has been given yet by other regulatory bodies like RBI and CERT-In.
Official statement
Limited data accessed but core banking infrastructure secure, says BoB
In its first official response, Bank of Baroda said the incident was due to an employee's email account being compromised.
This allowed unauthorized access to limited data but stressed that its core banking infrastructure was not breached and remains secure.
"The incident involved compromise of an employee's email account, resulting in unauthorized access to certain data," it said in a statement on Monday.