InfoSecBulletin Cybersecurity for mankind
India’s leading state-owned lender Bank of Baroda acknowledged Monday a security incident after reports that approximately 1 terabyte of customer and internal data surfaced online.
The incident stemmed from the “compromise of an employee’s email account, resulting in unauthorized access to certain data,” Bank of Baroda said in a post on X.
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
The statement followed claims that the TripleX ransomware group published the data on the dark web on July 24. The relatively new group, first observed in May, primarily uses a double-extortion model: stealing data first, then threatening to leak it. Public threat-intel trackers describe it as active, with victims that so far cluster around financial services and professional services.
Samples of the leaked archive include customer names, Aadhaar and PAN details, passport-size photographs, address proofs, identity documents, loan records and other information that together form what incident response specialist Ritesh Bhatia described as a “ready-made KYC kit.”
“Fraudsters don’t even need to work hard anymore,” Bhatia wrote in a LinkedIn post. “Mule accounts and SIM cards, sorted.”
Bhatia also said the leaked archive contains multiple versions of an internal spreadsheet, suggesting internal audit and compliance documents were exposed alongside customer information.
The bank has not disclosed how many customers may have been affected and whether the exposure was limited to specific regions, raising questions about the disclosure gap that India’s Digital Personal Data Protection Act is intended to close.
Under the DPDP Act and the DPDP Rules notified in November 2025, banks and other data fiduciaries will be required to notify both the Data Protection Board of India and every affected individual without undue delay after becoming aware of a personal data breach. Organizations must also submit a detailed report to the Board within 72 hours describing the nature of the breach, the categories of personal data affected, its likely consequences and the remedial measures taken. Customer notifications must similarly explain what data was compromised, the potential risks arising from the incident and the steps individuals should take to protect themselves. Failure to comply can attract penalties of up to 200 crore rupees – approximately $21 million.
Bhatia told that directors should assume a cyber incident is inevitable and determine in advance how they will communicate with customers and regulators.
“When cyberattacks strike, companies often prioritize quick fixes over reporting. But that approach exposes organizations to regulatory scrutiny and legal risk. The first 24 hours after a breach are critical and what’s done – or not done – shapes the outcome,” Shruti Dvivedi Sodhi, partner at Khaitan Legal Associates, told.
Bank of Baroda is one of India’s largest public sector undertaking banks, with more than $240 billion in assets and operations spanning 15 countries across Asia, Europe, Africa, North America and Australia. The bank serves millions of retail and corporate customers through an extensive domestic and international network, making any potential exposure of customer data significant in both scale and geographic reach.
