InfoSecBulletin Cybersecurity for mankind
India’s leading state-owned lender Bank of Baroda acknowledged Monday a security incident after reports that approximately 1 terabyte of customer and internal data surfaced online.
The incident stemmed from the “compromise of an employee’s email account, resulting in unauthorized access to certain data,” Bank of Baroda said in a post on X.
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
“PentesterFlow” AI Automation Tool for Penetration Testers and Bug Hunters
Jailbreak works against AI Models GPT-5.6, Claude Opus 5, and Fable, Claims Researcher
Researchers found security flaws in every script generated by ChatGPT, Copilot, and Gemini
Australian Energy Giant Origin confirms unauthorized access and disclosure of customer data
The statement followed claims that the TripleX ransomware group published the data on the dark web on July 24. The relatively new group, first observed in May, primarily uses a double-extortion model: stealing data first, then threatening to leak it. Public threat-intel trackers describe it as active, with victims that so far cluster around financial services and professional services.
Samples of the leaked archive include customer names, Aadhaar and PAN details, passport-size photographs, address proofs, identity documents, loan records and other information that together form what incident response specialist Ritesh Bhatia described as a “ready-made KYC kit.”
“Fraudsters don’t even need to work hard anymore,” Bhatia  wrote in a LinkedIn post. “Mule accounts and SIM cards, sorted.”
Bhatia also said the leaked archive contains multiple versions of an internal spreadsheet, suggesting internal audit and compliance documents were exposed alongside customer information.
The bank has not disclosed how many customers may have been affected and whether the exposure was limited to specific regions, raising questions about the disclosure gap that India’s Digital Personal Data Protection Act is intended to close.
Under the DPDP Act and the DPDP Rules notified in November 2025, banks and other data fiduciaries will be required to notify both the Data Protection Board of India and every affected individual without undue delay after becoming aware of a personal data breach. Organizations must also submit a detailed report to the Board within 72 hours describing the nature of the breach, the categories of personal data affected, its likely consequences and the remedial measures taken. Customer notifications must similarly explain what data was compromised, the potential risks arising from the incident and the steps individuals should take to protect themselves. Failure to comply can attract penalties of up to 200 crore rupees – approximately $21 million.
Bhatia told that directors should assume a cyber incident is inevitable and determine in advance how they will communicate with customers and regulators.
“When cyberattacks strike, companies often prioritize quick fixes over reporting. But that approach exposes organizations to regulatory scrutiny and legal risk. The first 24 hours after a breach are critical and what’s done – or not done – shapes the outcome,” Shruti Dvivedi Sodhi, partner at Khaitan Legal Associates, told.
Bank of Baroda is one of India’s largest public sector undertaking banks, with more than $240 billion in assets and operations spanning 15 countries across Asia, Europe, Africa, North America and Australia. The bank serves millions of retail and corporate customers through an extensive domestic and international network, making any potential exposure of customer data significant in both scale and geographic reach.
