VULNpocalypse
HighBreach / campaignOngoing

Bank of Baroda data leak: bank confirms employee email compromise after TripleX posts KYC and audit files

Bank of Baroda says a compromised employee email account exposed “certain data” after TripleX posted files said to hold KYC and loan documents on 24 Jul 2026.

Published
Updated
Exploitation
Yes. The bank confirmed unauthorized access to data through a compromised employee email account; files were posted on a leak site from 24 July 2026

What happened

  • 24 July 2026: a data-extortion group calling itself TripleX listed Bank of Baroda on its leak site, claiming about 1 TB of customer and internal data (BankInfoSecurity). Researcher Srikanth L of Cashless Consumer said the cache appeared on Saturday night and was advertised as more than 700 GB, based on metadata of the site (Reuters via The Star).
  • 26 July: a researcher posted the leak’s root folder listing on X and tagged the RBI and Cyber Dost (Outlook Business).
  • 27 July (Monday): Bank of Baroda confirmed an incident in a post on X: “compromise of an employee’s email account, resulting in unauthorized access to certain data” (BankInfoSecurity). It said the incident was promptly identified and contained, that it had started a forensic investigation, that it was working with the relevant authorities, and that “The bank’s core banking systems were not accessed and continue to remain secure” (Reuters via The Star; WION).

What the bank has not said: how many customers are affected, which data, which branches or regions, and when it found the compromise. The RBI and CERT-In did not respond to Reuters (Reuters via The Star). We found no later public update from the bank; as of 21 October the Internet Freedom Foundation still described it as a forensic investigation (IFF).

What the leak reportedly contains (claims and researcher analysis, not confirmed by the bank):

  • Customer names, Aadhaar and PAN details, passport-size photos, address proofs, identity documents and loan records, plus internal audit and compliance spreadsheets (BankInfoSecurity).
  • Account opening forms, KYC documents, loan appraisal notes, internal audit reports, vigilance handbooks and customer statements, about 15,774 files in 2,671 subdirectories under 95 top-level branch folders, concentrated in offices in Shivamogga (Karnataka) and Bhilwara (Rajasthan), per researcher analysis and an “intelligence report” cited by Outlook Business.
  • Hundreds of thousands of signed customer account forms, per ransomware.live citing the group (Republic).

How they got in. The bank says through one employee’s email account. The researcher quoted by Outlook Business suggested, with low to moderate confidence, that a weak password at a regional branch was the entry point. TripleX did not ask for a ransom; it posted the data for free download and said it wanted to punish the bank for weak passwords and security errors (Republic).

About TripleX. First observed in May 2026, it steals data and threatens to publish it (BankInfoSecurity). Its earlier claimed victim was Indonesia’s Bank Negara Indonesia, where it leaked customer contracts and passports (Republic).

Am I affected?

The bank has not said, and has not notified customers publicly. Treat yourself as possibly affected if:

  • you opened an account, completed KYC or applied for a loan at a Bank of Baroda branch, particularly in Shivamogga or Bhilwara, where the leaked files were reported to be concentrated;
  • you gave the branch photocopies of Aadhaar, PAN, a passport or an address proof.

Signs that your documents are being used:

  • Loans or credit cards you did not apply for on your credit report.
  • Aadhaar authentications you did not make. UIDAI says the Aadhaar app lets you check your authentication history (UIDAI).
  • A SIM card registered in your name that you do not own. The government’s Sanchar Saathi portal has a “Know Mobile Connections in Your Name” service where you can see them and report any that are not yours (Sanchar Saathi).

What to do now

  1. Lock your Aadhaar biometrics with UIDAI’s “Lock/Unlock Biometrics” service (UIDAI), one of the steps the researcher urged for Bank of Baroda customers (Outlook Business). Unlock it only when you need a biometric check.
  2. Pull your credit report now and again in three months. Leaked loan applications and KYC copies are what fraudsters need to take loans or open mule accounts in your name; incident responder Ritesh Bhatia warned that fraudsters “don’t even need to work hard anymore” (BankInfoSecurity).
  3. Turn on SMS and email alerts for every transaction and change your mobile and internet banking passwords, also on the researcher’s list (Outlook Business).
  4. Expect callers who know your account details. A caller who quotes your account number, loan amount or branch is not proof they work for the bank. Call the bank back on the number printed on your passbook or card.
  5. Indian banks and NBFCs: this leak came out of one employee mailbox, and the reported content is branch audit reports and scanned KYC files. Find out how much customer documentation sits in staff mailboxes and shared branch folders, restrict bulk download and forwarding of KYC attachments, and require phishing-resistant sign-in for branch email. Reporting clocks already apply: CERT-In requires incident reports within six hours and the RBI framework within two to six hours, while the DPDP Act’s duty to notify individuals takes effect in May 2027 (IFF).

Sources