Bank of Baroda data leak: Hacker claims 1TB customer data breach

Bank of Baroda is reportedly a central part of a huge cybersecurity ruckus, as another threat actor alleges that it has compromised the bank’s systems and published 1TB of sensitive data on the dark web. It is claimed that the leak consists of personal and corporate banking details like customer names, Aadhaar numbers, account details, loan history, internal banking documents from various branches in India. Also Read: 'Mother of All Data Breaches' leaks 26 billion records from Linked, X, Snap

As of the time of this writing, Bank of Baroda has released no official comment on the alleged breach. Likewise, Indian Computer Emergency Response Team (CERT-In) and Reserve Bank of India (RBI) have not issued any public statement confirming this.

1TB of banking data is leaked

The threat actor is said to have released the alleged 1TB collection for free on the darknet. The information leaked reportedly covers a broad range of banking information, both for customers and about the bank’s operations.

The claimed dataset is said to contain:

• The current account records, savings records.
• Name of the customer and their Aadhaar number.
• Loan application and appraisal documents
• NetBanking user information
• Records of NRI and corporate banking activities.
• Customer support documents
• Records of branches and ATMs related to them.
• Internal communications and audit reports

The leak, if confirmed, might be among the biggest in recent years in the Indian banking industry’s history.

Sample documents posted online

The “hacker” has also made sample documents publicly available to back up the claims of a hack.

Srikanth Lakshmanan, the founder of CashlessConsumer, shared links to the sample files on X, which it described as public. In a statement to India Today Tech, he said that it was a “cyber catastrophe.

Lakshmanan, he said, was able to check a few of the leaked files and found what he termed as “true Bank of Baroda documents.

He indicated that it is reported that the documents include:

• Branch audit reports
• Loan appraisal files
• Internal communications
• Vigilance investigation records
• bobWorld audit reports

These findings are grave but the authenticity of the leaked data and the amount of it has yet to be independently verified by the bank or government agencies.

Breach discovered on 25 July

The suspected break-in took place on ransomeware.live, which is a site that monitors ransomware and cybercrime activity on the dark web, on Saturday, July 25, according to Lakshmanan.

The site is said to have flagged the incident once it got the dataset from the threat actor.

Officially, it remains unknown when the alleged breach happened and if there was any direct breach in the Bank of Baroda’s production systems.

Who could be responsible for the alleged attack?

No  group has identified themselves as the hackers responsible for the alleged hack.

But, Lakshmanan thinks otherwise, as a relatively new cybercriminal group called TripleX may have been responsible.

He said that the same group was previously linked to a cyber attack on PT Bank Negara Indonesia, one of Indonesia’s biggest state owned banks.

In that incident, it was reportedly 2TB worth of sensitive data that the attackers took, consisting of financial records, contracts, personal identification data, transaction histories, and confidential banking documents.

According to Lakshmanan the attacker has now made the alleged Bank of Baroda data public on a website using the Tor network.

These allegations, however, have not been substantiated and no official investigation has blamed the alleged attack on any particular group.

Rising worries about cybersecurity in the banking sector

The event occurred when the amount of cyber threats against financial institutions has grown around the globe.

With the massive number of sensitive customer data and financial records, banks have emerged as easy target of cybercriminals. There have been many times when attackers have become more sophisticated and hacked into banking systems with ransomware, phishing and data theft attacks.

The potential for AI-powered cyberattacks has also led to tighter cybersecurity protocols and regulations by financial regulators and governments in recent months for financial institutions and banks.

What should be done by the customers of Bank of Baroda?

In the meantime, consumers should be vigilant and watch their accounts for suspicious transactions until the claim is officially substantiated or refuted.

Add Techlusive as a Preferred Source

Customers are advised to take the following precautions as a precaution:

• Regularly check account statements and transaction history.
• If you see any transactions that you do not recognize, report it right away.
• Don’t click on suspicious emails, SMS or phone calls that seem to be from the bank.
• Do not share OTPs, passwords, pin or bank information.
• If the bank issues any official security advisory, update the NetBanking passwords.