InfoSecBulletin Cybersecurity for mankind
India’s leading state-owned lender Bank of Baroda acknowledged Monday a security incident after reports that approximately 1 terabyte of customer and internal data surfaced online.
The incident stemmed from the “compromise of an employee’s email account, resulting in unauthorized access to certain data,” Bank of Baroda said in a post on X.
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
The statement followed claims that the TripleX ransomware group published the data on the dark web on July 24. The relatively new group, first observed in May, primarily uses a double-extortion model: stealing data first, then threatening to leak it. Public threat-intel trackers describe it as active, with victims that so far cluster around financial services and professional services.
Samples of the leaked archive include customer names, Aadhaar and PAN details, passport-size photographs, address proofs, identity documents, loan records and other information that together form what incident response specialist Ritesh Bhatia described as a “ready-made KYC kit.”
“Fraudsters don’t even need to work hard anymore,” Bhatia  wrote in a LinkedIn post. “Mule accounts and SIM cards, sorted.”
Bhatia also said the leaked archive contains multiple versions of an internal spreadsheet, suggesting internal audit and compliance documents were exposed alongside customer information.
The bank has not disclosed how many customers may have been affected and whether the exposure was limited to specific regions, raising questions about the disclosure gap that India’s Digital Personal Data Protection Act is intended to close.
Under the DPDP Act and the DPDP Rules notified in November 2025, banks and other data fiduciaries will be required to notify both the Data Protection Board of India and every affected individual without undue delay after becoming aware of a personal data breach. Organizations must also submit a detailed report to the Board within 72 hours describing the nature of the breach, the categories of personal data affected, its likely consequences and the remedial measures taken. Customer notifications must similarly explain what data was compromised, the potential risks arising from the incident and the steps individuals should take to protect themselves. Failure to comply can attract penalties of up to 200 crore rupees – approximately $21 million.
Bhatia told that directors should assume a cyber incident is inevitable and determine in advance how they will communicate with customers and regulators.
“When cyberattacks strike, companies often prioritize quick fixes over reporting. But that approach exposes organizations to regulatory scrutiny and legal risk. The first 24 hours after a breach are critical and what’s done – or not done – shapes the outcome,” Shruti Dvivedi Sodhi, partner at Khaitan Legal Associates, told.
Bank of Baroda is one of India’s largest public sector undertaking banks, with more than $240 billion in assets and operations spanning 15 countries across Asia, Europe, Africa, North America and Australia. The bank serves millions of retail and corporate customers through an extensive domestic and international network, making any potential exposure of customer data significant in both scale and geographic reach.
