Bank of Baroda Probes 700GB Data Leak
Dark web files allegedly include customer identities, loan documents, account records, and internal audit material.
Topics
[Image source: Krishna Prasad/MITSMR India]
Over 700 gigabytes of data associated with the Bank of Baroda have been uploaded to the dark web. The compromised data comprises customer identity documents, loan records, and internal files, which has led the state-owned financial institution to initiate a forensic investigation.
The data was released online on Saturday and promoted by the hacking group TripleX as being stolen from the bank. Some reports estimated the total at nearly one terabyte, but the dataset’s full size and authenticity haven’t been independently confirmed.
The exposed material allegedly includes customer photographs, Aadhaar details, account-opening forms, savings and current account information, loan applications, NetBanking records, and documents relating to non-resident Indian and corporate banking services.
Internal audit records and other operational documents were also found among the files, according to cybersecurity researchers who reviewed the dark web listing.
Bank of Baroda said a compromised employee email account led to unauthorized access to some data. The bank implemented containment measures and began working with the relevant authorities to determine the extent of the incident.
Its core banking systems, which process customer accounts and transactions, were not accessed and remained secure, the lender said. The bank has not disclosed how the employee account was compromised, when the unauthorized access began, or how many customers may have been affected.
The Reserve Bank of India and the Indian Computer Emergency Response Team had not publicly commented on the incident.
TripleX has previously claimed responsibility for attacks on financial institutions, including an alleged theft of about two terabytes of data from Indonesia’s state-owned Bank Negara Indonesia in May.
Bank of Baroda’s investigation is expected to determine whether the posted files are genuine, the systems from which they originated, and whether attackers gained access beyond the compromised email account.
