InfoSecBulletin Cybersecurity for mankind
India’s leading state-owned lender Bank of Baroda acknowledged Monday a security incident after reports that approximately 1 terabyte of customer and internal data surfaced online.
The incident stemmed from the “compromise of an employee’s email account, resulting in unauthorized access to certain data,” Bank of Baroda said in a post on X.
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
The statement followed claims that the TripleX ransomware group published the data on the dark web on July 24. The relatively new group, first observed in May, primarily uses a double-extortion model: stealing data first, then threatening to leak it. Public threat-intel trackers describe it as active, with victims that so far cluster around financial services and professional services.
Samples of the leaked archive include customer names, Aadhaar and PAN details, passport-size photographs, address proofs, identity documents, loan records and other information that together form what incident response specialist Ritesh Bhatia described as a “ready-made KYC kit.”
“Fraudsters don’t even need to work hard anymore,” Bhatia wrote in a LinkedIn post. “Mule accounts and SIM cards, sorted.”
Bhatia also said the leaked archive contains multiple versions of an internal spreadsheet, suggesting internal audit and compliance documents were exposed alongside customer information.
The bank has not disclosed how many customers may have been affected and whether the exposure was limited to specific regions, raising questions about the disclosure gap that India’s Digital Personal Data Protection Act is intended to close.
Under the DPDP Act and the DPDP Rules notified in November 2025, banks and other data fiduciaries will be required to notify both the Data Protection Board of India and every affected individual without undue delay after becoming aware of a personal data breach. Organizations must also submit a detailed report to the Board within 72 hours describing the nature of the breach, the categories of personal data affected, its likely consequences and the remedial measures taken. Customer notifications must similarly explain what data was compromised, the potential risks arising from the incident and the steps individuals should take to protect themselves. Failure to comply can attract penalties of up to 200 crore rupees – approximately $21 million.
Bhatia told that directors should assume a cyber incident is inevitable and determine in advance how they will communicate with customers and regulators.
“When cyberattacks strike, companies often prioritize quick fixes over reporting. But that approach exposes organizations to regulatory scrutiny and legal risk. The first 24 hours after a breach are critical and what’s done – or not done – shapes the outcome,” Shruti Dvivedi Sodhi, partner at Khaitan Legal Associates, told.
Bank of Baroda is one of India’s largest public sector undertaking banks, with more than $240 billion in assets and operations spanning 15 countries across Asia, Europe, Africa, North America and Australia. The bank serves millions of retail and corporate customers through an extensive domestic and international network, making any potential exposure of customer data significant in both scale and geographic reach.
