Bank of Baroda hit by cyberattack; 1TB of sensitive data allegedly leaked

Bank of Baroda is currently grappling with a significant data breach, as a hacker claims to have infiltrated its systems and leaked a staggering 1TB of sensitive information on the dark web. Reports indicate that this data is being offered for free download, creating serious concerns about customer privacy and security. According to a report from India Today, the compromised data includes a range of sensitive details, such as customer names, Aadhaar numbers, banking information, records related to corporate banking, and loan documents. This extensive leak reportedly encompasses information from numerous Bank of Baroda branches throughout India. To substantiate the breach, the hacker has shared sample documents online. Software engineer Srikanth Lakshmanan, who is also the founder of CashlessConsumer, posted these documents on social media platform X, asserting that the link to the leaked data remains active. He stated, "Root folder of the data dump of @bankofbaroda #Databreach by threat actor. More verification links in the thread. The link is live." Lakshmanan noted that the breach was initially detected on July 25 by a dark web monitoring site known as ransomware.live. The leaked data comprises both internal bank documents and personal customer information, including branch audit reports and internal communications. Despite the severity of the situation, Bank of Baroda, the Reserve Bank of India (RBI), and CERT-In have yet to comment or confirm the data breach. No cybercriminal group has officially taken responsibility for this incident; however, Lakshmanan speculates that a hacking group called "TripleX" may be behind the attack. This group was previously associated with a breach involving over 2TB of data from an Indonesian bank, which included contracts and personal identification details. In light of these developments, customers and partners of Bank of Baroda are advised to remain vigilant against suspicious account activities, monitor their credit reports, and adhere to standard cyber hygiene practices until further investigations are conducted by regulatory authorities.