InfoSecBulletin Cybersecurity for mankind
India’s leading state-owned lender Bank of Baroda acknowledged Monday a security incident after reports that approximately 1 terabyte of customer and internal data surfaced online.
The incident stemmed from the “compromise of an employee’s email account, resulting in unauthorized access to certain data,” Bank of Baroda said in a post on X.
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
The statement followed claims that the TripleX ransomware group published the data on the dark web on July 24. The relatively new group, first observed in May, primarily uses a double-extortion model: stealing data first, then threatening to leak it. Public threat-intel trackers describe it as active, with victims that so far cluster around financial services and professional services.
Samples of the leaked archive include customer names, Aadhaar and PAN details, passport-size photographs, address proofs, identity documents, loan records and other information that together form what incident response specialist Ritesh Bhatia described as a “ready-made KYC kit.”
“Fraudsters don’t even need to work hard anymore,” Bhatia  wrote in a LinkedIn post. “Mule accounts and SIM cards, sorted.”
Bhatia also said the leaked archive contains multiple versions of an internal spreadsheet, suggesting internal audit and compliance documents were exposed alongside customer information.
The bank has not disclosed how many customers may have been affected and whether the exposure was limited to specific regions, raising questions about the disclosure gap that India’s Digital Personal Data Protection Act is intended to close.
Under the DPDP Act and the DPDP Rules notified in November 2025, banks and other data fiduciaries will be required to notify both the Data Protection Board of India and every affected individual without undue delay after becoming aware of a personal data breach. Organizations must also submit a detailed report to the Board within 72 hours describing the nature of the breach, the categories of personal data affected, its likely consequences and the remedial measures taken. Customer notifications must similarly explain what data was compromised, the potential risks arising from the incident and the steps individuals should take to protect themselves. Failure to comply can attract penalties of up to 200 crore rupees – approximately $21 million.
Bhatia told that directors should assume a cyber incident is inevitable and determine in advance how they will communicate with customers and regulators.
“When cyberattacks strike, companies often prioritize quick fixes over reporting. But that approach exposes organizations to regulatory scrutiny and legal risk. The first 24 hours after a breach are critical and what’s done – or not done – shapes the outcome,” Shruti Dvivedi Sodhi, partner at Khaitan Legal Associates, told.
Bank of Baroda is one of India’s largest public sector undertaking banks, with more than $240 billion in assets and operations spanning 15 countries across Asia, Europe, Africa, North America and Australia. The bank serves millions of retail and corporate customers through an extensive domestic and international network, making any potential exposure of customer data significant in both scale and geographic reach.
