Bank of Baroda says compromised employee email exposed certain data

Bank of Baroda said in a statement on X that the matter was identified promptly and that immediate containment measures were implemented. It said a forensic investigation had begun and that it was working with relevant authorities under applicable regulatory requirements.

What the threat actor claims

Posts on a dark web forum alleged close to 1TB of data covering personal and corporate banking records, with samples and download links shared. The listing appeared on the night of Saturday 25 July, the Times of India reported. One advertisement offered a cache of more than 700GB. India Today reported that the claimed material includes Aadhaar numbers, names, savings and current account details, loan documents, NetBanking user details, NRI and corporate banking records, customer support files, and branch and ATM data.

Republic World reported that the exposed repository included photographs of Aadhaar cards and that TripleX published the data for free rather than seeking payment, saying it wanted to punish the bank over weak passwords. The group was first observed in May 2026 and was previously linked to a claimed 2TB breach at Bank Negara Indonesia, roughly double the volume alleged here, according to Hindustan Times.

Srikanth Lakshmanan, founder of CashlessConsumer, said the leak was first flagged on 25 July by ransomware.live. He said he had checked internal documents including branch audits, loan appraisal papers, internal communications, vigilance investigations and bobWorld audit reports. He challenged the bank's account. "Email access compromise cannot lead to exfiltration of multi hundred gigabytes of data," he wrote on X, urging the lender to publish a detailed report and alert affected customers.

Bank of Baroda has not confirmed the extent or nature of the data involved, and the authenticity of the files has not been independently verified.

Customer accounts

Sudiptaa Paul Choudhury, chief marketing officer at QNu Labs, said what is alleged is a data breach, not a banking-systems breach, and that nobody is reporting unauthorised fund transfers. She said deposits remain covered by DICGC insurance of up to ₹5 lakh per bank per depositor. Lakshmanan said the bank's transactional system does not appear to be affected, while its internal file sharing does.

India Today reported that the one-time password check remains in place, so the leaked files alone will not move funds, and that the files seen so far appeared to contain customer details and audit information, not passwords or PINs. Subir Sangal, chief executive of Eagle Information Systems, advised customers to change passwords, turn on multi-factor authentication where available and watch account activity.

CashlessConsumer built a branch checker that lets customers enter an IFSC code to see whether their branch is among 1,088 identified as likely exposed. Lakshmanan said individual notification is not possible, something he said the bank should do. Anirban Mukherji, chief executive of miniOrange, said services let people check whether an email or phone number appeared in known breaches, and advised reviewing bank statements and credit reports.

Regulatory scrutiny

India Today reported that regulators are expected to examine how the incident occurred and whether the bank complied with cybersecurity requirements. The Reserve Bank of India could review whether the lender met its cybersecurity and risk management framework, and CERT-In may examine whether the incident was reported under its six-hour breach reporting rule.

Choudhury said the DPDP Act allows penalties of up to ₹250 crore for inadequate security safeguards and up to ₹200 crore for failing to report a breach. She said Section 43A of the Information Technology Act exposes companies to compensation claims over negligent handling of sensitive personal data. The Data Protection Board is already operational, but the penalty machinery formally switches on in November, she said.

No penalty is automatic: the forensic findings and the regulators' assessment will decide whether action is warranted, India Today reported. At the time of the reports, neither CERT-In nor the Reserve Bank of India had publicly confirmed the breach.

What happens next

Bank of Baroda has not given a timeline for its forensic investigation, Digit reported. The RBI can direct stronger controls or impose penalties if violations are established, according to India Today.