Yes Bank: Bank of Baroda Hit by Cyberattack

Bank of Baroda Investigates Alleged 1TB Data Leak Following Employee Email Breach

State-owned Bank of Baroda (BoB) is probing a suspected cyberattack after nearly 1 terabyte (1TB) of sensitive banking data including customer account details, loan records, NRI and corporate banking information, and ATM-related records was allegedly leaked on the dark web. The breach, first reported on July 24, was flagged by dark web monitoring platform Ransomware.live, which claimed the dataset contained 100,000–300,000 customer application forms with photographs and identity documents.

BoB confirmed that the incident stemmed from the compromise of an employee’s email account, which granted unauthorized access to certain data. However, the bank emphasized that its core banking systems remained secure and unaffected. Immediate containment measures were implemented, and a forensic investigation is underway in coordination with regulatory authorities.

While no hacking group has officially claimed responsibility, reports suggest the TripleX collective may be linked to the leak. The breach adds to a growing trend of cyber incidents in India’s banking sector, including recent attacks on Yes Bank, ICICI Bank, and a 2016 malware-driven theft of 3.2 million card details from Yes Bank ATMs managed by Hitachi Payment Services.

BoB stated it maintains robust security protocols and remains committed to safeguarding customer data. The full scope and impact of the breach are still under assessment.

Source: https://www.rediff.com/business/report/bank-of-baroda-hit-by-cyberattack/20260728.htm

Bank of Baroda cybersecurity rating report: https://www.rankiteo.com/company/bankofbaroda

"id": "BAN1785400257",
"linkid": "bankofbaroda",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '100,000–300,000',
                        'industry': 'Banking/Financial Services',
                        'location': 'India',
                        'name': 'Bank of Baroda',
                        'type': 'Bank'}],
 'attack_vector': 'Compromised Employee Email Account',
 'data_breach': {'data_exfiltration': 'Yes (allegedly leaked on dark web)',
                 'number_of_records_exposed': '100,000–300,000',
                 'personally_identifiable_information': 'Yes (photographs, '
                                                        'identity documents)',
                 'sensitivity_of_data': 'High (PII, financial records)',
                 'type_of_data_compromised': ['Customer account details',
                                              'Loan records',
                                              'NRI banking information',
                                              'Corporate banking information',
                                              'ATM-related records',
                                              'Customer application forms with '
                                              'photographs and identity '
                                              'documents']},
 'date_detected': '2024-07-24',
 'date_publicly_disclosed': '2024-07-24',
 'description': 'State-owned Bank of Baroda (BoB) is probing a suspected '
                'cyberattack after nearly 1 terabyte (1TB) of sensitive '
                'banking data including customer account details, loan '
                'records, NRI and corporate banking information, and '
                'ATM-related records was allegedly leaked on the dark web. The '
                'breach was first reported on July 24 and flagged by dark web '
                'monitoring platform Ransomware.live, which claimed the '
                'dataset contained 100,000–300,000 customer application forms '
                'with photographs and identity documents. BoB confirmed the '
                'incident stemmed from the compromise of an employee’s email '
                'account but emphasized its core banking systems remained '
                'secure and unaffected.',
 'impact': {'data_compromised': '1TB of sensitive banking data',
            'identity_theft_risk': 'High (PII exposed)',
            'systems_affected': 'Employee email account (core banking systems '
                                'unaffected)'},
 'initial_access_broker': {'entry_point': 'Employee email account'},
 'investigation_status': 'Ongoing (forensic investigation underway)',
 'references': [{'date_accessed': '2024-07-24', 'source': 'Ransomware.live'}],
 'regulatory_compliance': {'regulatory_notifications': 'Yes (coordination with '
                                                       'regulatory '
                                                       'authorities)'},
 'response': {'communication_strategy': 'Public statement confirming breach '
                                        'and core system security',
              'containment_measures': 'Immediate containment measures '
                                      'implemented',
              'incident_response_plan_activated': 'Yes'},
 'threat_actor': 'TripleX (alleged)',
 'title': 'Bank of Baroda Investigates Alleged 1TB Data Leak Following '
          'Employee Email Breach',
 'type': 'Data Breach'}