Bank of Baroda has confirmed a cybersecurity incident involving a compromised employee email account after reports emerged that nearly 1TB of data allegedly linked to the state-owned lender had been published on the Dark Web.
The bank said the compromised account resulted in unauthorised access to certain data, but clarified that its core banking systems were not accessed and continue to remain secure. It said the incident was identified promptly, containment measures were implemented, and a comprehensive forensic investigation has been launched in coordination with relevant authorities.
The confirmation followed reports from the X account DailyDarkWeb and cybersecurity researcher Srikanth Lakshmanan, founder of CashlessConsumer, who flagged an alleged large-scale data dump connected to Bank of Baroda.
According to the claims, the dataset contains personal and corporate banking records, including savings and current account information, loan records, NetBanking users, NRI and corporate banking services, customer-support documents, and records linked to branches and ATMs. Reports from researchers also said the material included customer details, identification documents and internal audit records.
Samples and download links were reportedly shared alongside the threat actor's claim of possessing approximately 1TB of data.
However, the size of the alleged dataset has not been independently established by Bank of Baroda. Reuters reported that the Dark Web listing was advertised as a cache exceeding 700GB based on metadata analysis conducted by Lakshmanan. The number of customers whose information may have been exposed also remains unknown.
This distinction is important. The appearance of a large archive online does not, by itself, establish that every file originated from Bank of Baroda or that the entire advertised volume was successfully exfiltrated from the bank.
What allegedly appeared in the data dump?
The initial claims described a wide range of banking information. This reportedly included savings and current account records, loan-related documents, NetBanking information, NRI and corporate banking records, customer-support material, and branch and ATM data.
Other reports said samples contained highly sensitive information such as Aadhaar details, customer names, loan documents and other identity-related records. Some reports citing the claims placed the number of customer application forms potentially involved between 100,000 and 300,000. These figures remain allegations and have not been confirmed by Bank of Baroda.
Lakshmanan also shared screenshots that he said showed the root folder of the alleged data dump and reported that the download link was active. He described the incident as a "cyber disaster" and called for the Reserve Bank of India (RBI) and National Payments Corporation of India (NPCI) to consider disconnecting the bank's systems while the extent of the compromise was investigated.
At the time of those warnings, the source and method of the alleged data theft were unclear.
Bank of Baroda's subsequent statement has now provided an important piece of that picture.
Employee email account was the confirmed entry point
According to the bank, the confirmed incident involved the compromise of an employee's email account. The account was then used to obtain unauthorised access to certain data.
Bank of Baroda has not disclosed how the email account was compromised, what specific files were accessed, or whether all of the data advertised on the Dark Web originated through that account.
The lender has, however, clearly stated that its core banking systems were not accessed and remain secure.
That distinction matters because compromising an employee's email account is not the same as compromising the systems that process customer transactions.
At the same time, an email account inside a large financial institution can provide access to highly sensitive material. Depending on the employee's role and permissions, an account may contain customer correspondence, loan documents, identity records, internal reports or links to shared resources.
The incident therefore demonstrates how an attacker may be able to obtain valuable financial information without directly breaching the core platform responsible for banking transactions.
Customer risk extends beyond stolen funds
There is currently no public evidence that the alleged incident allowed attackers to directly access customer balances or manipulate transactions. Bank of Baroda has specifically said that its core banking systems were not accessed.
The potential exposure of personal and financial records nevertheless creates a separate risk.
Information such as customer names, identity documents, account-related details and loan records could give criminals material for highly targeted phishing and impersonation attempts. A scammer with genuine information about a customer's banking relationship can make fraudulent calls, emails or messages appear far more credible.
Customers
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: