-
A reported dark-web leak may have exposed Bank of Baroda customer data and sensitive internal documents.
-
The alleged data includes Aadhaar numbers, account records, loan details, and NetBanking information.
-
Bank of Baroda is reportedly conducting a forensic audit, but the full impact remains unclear.
A threat actor has reportedly posted customer and internal data linked to Bank of Baroda on the dark web. The alleged leak includes sensitive records belonging to customers of the Indian state-run bank.
Cybersecurity researcher Srikanth L, founder of Cashless Consumer, reported the alleged data exposure. A source familiar with the matter also confirmed the incident and said the bank started a forensic audit. The investigation aims to find out how the data became exposed and how much information was leaked.
The number of customers affected remains unknown at this time. Bank of Baroda has not publicly confirmed how many people may have suffered from the alleged leak. The Reserve Bank of India and India’s cybersecurity regulator CERT-In also had not responded. The responses were not available at the time of reporting.
Data Allegedly Advertised as 700GB Cache
According to the source, the incident may have started with a compromised email system. However, investigators have not yet confirmed how attackers gained access to the information. Srikanth said the data appeared on a dark-web site on Saturday night. The seller reportedly advertised the information as a cache containing more than 700 gigabytes of data.
Metadata linked to the listing reportedly showed the size of the alleged dataset. The Economic Times also reported that the data may contain several types of customer information. The alleged records reportedly include Aadhaar numbers and customer names.
They may also contain savings accounts, current accounts, loan records, and NetBanking user details. The reported data may also include information from NRI banking and corporate banking services. Other alleged records reportedly involve customer support, bank branches, and ATMs.
However, no independent verification has confirmed that all the advertised data is genuine. It also remains unclear whether the entire dataset belongs to Bank of Baroda customers. The alleged leak has raised concerns because banks hold large amounts of sensitive customer information. The verification challenges mirror those in other unverified banking claims, a hacker has alleged the sale of 638,000 federal bank records.
Such information can include identity records, financial details, and private customer communications. Criminals could seek to use stolen information for scams, fraud, or identity theft. However, the reported risks remain potential threats until investigators confirm the data’s authenticity.
Bank’s Investigation Underway
Bank of Baroda has not formally confirmed the reported data leak. The bank has also not announced the number of customers who may have been affected. The reported forensic audit could help investigators understand what happened.
It may also show whether the leaked information is genuine and how attackers accessed it. The investigation could further reveal whether attackers reached customer accounts or other bank systems.
The reported incident also highlights the risks linked to compromised business email systems. Attackers who enter an employee’s email account may find private messages and sensitive attachments.
They may also use information from those accounts to reach other systems. The Bank of Baroda report follows other alleged cyber incidents involving Indian organisations. In June, attackers reportedly targeted Tata Electronics, a supplier to Apple.
The incident allegedly led to Apple and Tesla component designs and specifications appearing on the dark web. Earlier this month, the ransomware group World Leaks reportedly published files linked to India’s largest nuclear power plant.
Those incidents show the types of data that threat actors may claim to steal and publish. However, the Bank of Baroda case remains under investigation, and key details have yet to be confirmed.
Full Scope of Reported Leak Remains Unclear
The alleged appearance of more than 700 gigabytes of data has raised concerns about the incident. The reported dataset may contain customer records and sensitive documents from inside the bank.
However, the available information does not confirm that every record in the listing is real. It also does not confirm that the data came entirely from the Bank of Baroda. The bank’s forensic audit should help establish the source and size of the alleged exposure.
It may also determine whether attackers accessed customer accounts or other internal systems. Until the investigation provides more answers, the number of affected customers remains unknown. The bank has also not publicly confirmed the authenticity of the dark-web listing. For now, the alleged leak remains an unconfirmed data exposure involving a major Indian financial institution.
The reported incident highlights concerns around the protection of customer and internal banking information. However, the full scope of the alleged exposure will only become clear after the investigation ends.
